GitHub Advisoryadvisory · RubyGems, npm, PyPI

GHSA-4xqv-47rm-37mm OpenC3 stores passwords in clear text (`GHSL-2024-129`)

MEDIUM Published 2024-10-02 Modified 2024-11-13 Official page ↗
Aliases
CVE-2024-47529
Ecosystem
RubyGems, npm, PyPI
Packages
openc3, @openc3/tool-common
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-312, CWE-522
Reviewed
2024-10-02

Affected packages

• RubyGems openc3: < 5.19.0 → fixed in 5.19.0 • npm @openc3/tool-common: < 5.19.0 → fixed in 5.19.0 • PyPI openc3: < 5.19.0 → fixed in 5.19.0

Description

Summary OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128). Note: This CVE only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition Impact This issue may lead to Information Disclosure.

Related

Alias · CVE (1)

  • CVE-2024-47529 OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. vulnerability

Weakness · CWE (2)

  • CWE-312 Cleartext Storage of Sensitive Information weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References