GitHub Advisoryadvisory · Maven

GHSA-3g4c-hjhr-73rj CometVisu Backend for openHAB has a sensitive information disclosure vulnerability

MEDIUM Published 2024-08-09 Modified 2024-08-12 Official page ↗
Aliases
CVE-2024-42470
Ecosystem
Maven
Packages
org.openhab.ui.bundles:org.openhab.ui.cometvisu
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-862
Reviewed
2024-08-09

Affected packages

• Maven org.openhab.ui.bundles:org.openhab.ui.cometvisu: < 4.2.1 → fixed in 4.2.1

Description

Several endpoints in the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. Impact This issue may lead to sensitive Information Disclosure.

Related

Alias · CVE (1)

  • CVE-2024-42470 openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References