CVE-2024-8862 | h2oai h2o-3 3.46.0.4 JDBC Connection /dtale/chart-data/1 getConnectionSafe query deserialization

A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale/chart-data/1 of the component JDBC Connection Handler. The manipulation of the argument query leads to deserialization.

The identification of this vulnerability is CVE-2024-8862. The attack may be initiated remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.