OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128). This vulnerability is fixed in 5.19.0. This only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition.
References
| Link | Resource |
|---|---|
| https://github.com/OpenC3/cosmos/security/advisories/GHSA-4xqv-47rm-37mm | Vendor Advisory |
| https://github.com/OpenC3/cosmos/commit/b5ab34fe7fa54c0c8171c4aa3caf4e03d6f63bd7 | Patch |
| https://securitylab.github.com/advisories/GHSL-2024-127_GHSL-2024-129_OpenC3_COSMOS | Exploit Third Party Advisory |
Configurations
History
13 Nov 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/OpenC3/cosmos/commit/b5ab34fe7fa54c0c8171c4aa3caf4e03d6f63bd7 - Patch | |
| References | () https://securitylab.github.com/advisories/GHSL-2024-127_GHSL-2024-129_OpenC3_COSMOS - Exploit, Third Party Advisory | |
| References | () https://github.com/OpenC3/cosmos/security/advisories/GHSA-4xqv-47rm-37mm - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| First Time |
Openc3 cosmos
Openc3 |
|
| CPE | cpe:2.3:a:openc3:cosmos:*:*:*:*:open_source:*:*:* |
31 Oct 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Oct 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-02 20:15
Updated : 2024-11-13 17:15
NVD link : CVE-2024-47529
Mitre link : CVE-2024-47529
JSON object : View
Products Affected
openc3
- cosmos
CWE
No CWE.