CVE-2024-42468

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-42468
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42468.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-42468
Aliases
Published
2024-08-12T13:38:34Z
Modified
2024-10-07T23:30:58Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4.2.1 is susceptible to an unauthenticated path traversal vulnerability. Local files on the server can be requested via HTTP GET on the CometVisuServlet. This issue may lead to information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.

References

Affected packages

Git / github.com/openhab/openhab-addons

Affected ranges

Type
GIT
Repo
https://github.com/openhab/openhab-addons
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d18df74c4b16c63a914845938b49e8ff597a40f2
Type
GIT
Repo
https://github.com/openhab/openhab-webui
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
630e8525835c698cf58856aa43782d92b18087f2