CVE-2023-6016: Improper Control of Generation of Code ('Code Injection')

November 16, 2023 (updated November 28, 2023)

An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it’s POJO model import feature.

References

huntr.com/bounties/83dd17ec-053e-453c-befb-7d6736bf1836
nvd.nist.gov/vuln/detail/CVE-2023-6016

Code Behaviors & Features

Detect and mitigate CVE-2023-6016 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →