| عنوان | h2oai h2o-3 <=v3.46.08 Deserialization |
|---|
| الوصف | In H2O-3, the existing JDBC deserialization defense mechanisms only cover MySQL and H2 drivers. However, since H2O-3 is designed to support importing SQL tables from multiple database sources, when IBM DB2 is used as the database backend, it becomes possible to exploit JDBC deserialization, leading to remote code execution (RCE). |
|---|
| المصدر | ⚠️ https://github.com/ez-lbz/poc/issues/50 |
|---|
| المستخدم | ez-lbz (UID 87033) |
|---|
| ارسال | 06/09/2025 12:09 PM (1 سنة منذ) |
|---|
| الاعتدال | 21/09/2025 10:16 AM (15 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 325124 [h2oai h2o-3 حتى 3.46.08 IBMDB2 JDBC Driver /99/ImportSQLTable connection_url تجاوز الصلاحيات] |
|---|
| النقاط | 18 |
|---|