CVE-2024-42468

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-42468
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4.2.1 is susceptible to an unauthenticated path traversal vulnerability. Local files on the server can be requested via HTTP GET on the CometVisuServlet. This issue may lead to information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/openhab/openhab-webui/security/advisories/GHSA-pcwp-26pw-j98w Vendor Advisory
https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2 Patch
https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/servlet/CometVisuServlet.java#L75 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:openhab:openhab:*:*:*:*:*:*:*:*
History

12 Sep 2024, 16:01

Type Values Removed Values Added
CWE CWE-22
First Time Openhab
Openhab openhab
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:openhab:openhab:*:*:*:*:*:*:*:*
References () https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/servlet/CometVisuServlet.java#L75 - () https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/servlet/CometVisuServlet.java#L75 - Patch
References () https://github.com/openhab/openhab-webui/security/advisories/GHSA-pcwp-26pw-j98w - () https://github.com/openhab/openhab-webui/security/advisories/GHSA-pcwp-26pw-j98w - Vendor Advisory
References () https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2 - () https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2 - Patch

12 Aug 2024, 13:41

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-12 13:38

Updated : 2024-09-12 16:01

NVD link : CVE-2024-42468

Mitre link : CVE-2024-42468

JSON object : View

Products Affected

openhab

  • openhab
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')