by Kastro
Paper/Archive/CVE-2024-42470

CVE-2024-42470

openhab openhab-webui — CometVisu Backend for openHAB has a sensitive information disclosure vulnerability

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 44.4.444 × 208.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.

Affected

ProductAffectedFixed inSource
openhab-webui< 4.2.1–CNA
openhab_webui< 4.2.14.2.1CISA-ADP

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/openhab/openhab-webui/security/advisories/GHSA-3g4c-hjhr-73rjrefgithub.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2