CVE-2023-6013— H2O Local File Include
Quick assessment
Affected
h2oai h2oai/h2o-3
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
H2O是一个用于分布式、可扩展机器学习的内存平台。 H2O存在安全漏洞，该漏洞源于存在存储型跨站脚本（XSS）漏洞。攻击者可利用该漏洞造成本地文件包含。
Possible ATT&CK Techniques 2 AI
T1048 · Exfiltration Over Alternative Protocol T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-6013
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
H2O Local File Include
Source: CVE Program / CVE List V5
Vulnerability Description
H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
H2O 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
H2O是一个用于分布式、可扩展机器学习的内存平台。 H2O存在安全漏洞，该漏洞源于存在存储型跨站脚本（XSS）漏洞。攻击者可利用该漏洞造成本地文件包含。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| h2oai | h2oai/h2o-3 | unspecified ~ latest | - |
|
II. Public POCs for CVE-2023-6013
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-6013
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-6013 (1)
Same Patch Batch · h2oai · 2023-11-16 · 4 CVEs total
| CVE-2023-6016 | H2O Remote Code Execution via POJO Model Import | |
| CVE-2023-6017 | H2O S3 Bucket Takeover | |
| CVE-2023-6038 | Local File Inclusion in h2oai/h2o-3 |
IV. Related Vulnerabilities
Same product: h2oai/h2o-3
-
CVE-2026-3960
Remote Code Execution in h2oai/h2o-3 -
CVE-2024-5986
Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o -
CVE-2025-6544
Deserialization Vulnerability in h2oai/h2o-3 -
CVE-2025-5662
Deserialization Vulnerability in h2oai/h2o-3 -
CVE-2025-6507
Deserialization of Untrusted Data in h2oai/h2o-3
Same vendor: h2oai
-
CVE-2026-65700
h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API -
CVE-2026-8752
h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java -
CVE-2026-8751
h2oai h2o-3 JAR Model.java importBinaryModel deserialization -
CVE-2026-8750
h2oai h2o-3 ImportFile API PersistNFS.java importFiles infor -
CVE-2026-3960
Remote Code Execution in h2oai/h2o-3
Same weakness: CWE-79
-
CVE-2023-5648
Brocade ASCG v3.0以下版本HTTP头缺失漏洞 -
CVE-2026-94154
Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site -
CVE-2026-95595
WordPress Disable and Remove Google Fonts | GDPR & DSGVO fri -
CVE-2026-94670
WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripti -
CVE-2026-94662
WordPress Unlimited Elements For Elementor plugin <= 2.0.19
V. Comments for CVE-2023-6013
No comments yet