openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.
References
Configurations
History
12 Sep 2024, 16:04
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-862 | |
| First Time |
Openhab
Openhab openhab |
|
| References | () https://github.com/openhab/openhab-webui/security/advisories/GHSA-3g4c-hjhr-73rj - Vendor Advisory | |
| References | () https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2 - Patch | |
| CPE | cpe:2.3:a:openhab:openhab:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
12 Aug 2024, 13:41
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-08-12 13:38
Updated : 2024-09-12 16:04
NVD link : CVE-2024-42470
Mitre link : CVE-2024-42470
JSON object : View
Products Affected
openhab
- openhab
CWE
CWE-862
Missing Authorization