Vulnerability · Published Aug 9, 2024 · Assigned by GitHub_M
CVE-2024-42470CometVisu Backend for openHAB has a sensitive information disclosure vulnerability
Medium 6.5
In plain English
A medium-severity missing authorization in openhab-webui from openhab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.openhab.ui.bundles:org.openhab.ui.cometvisu | 4.2.1 | GHSA-3g4c-hjhr-73rj |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| openhab | openhab-webui | < 4.2.1 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N