CVE-2024-42469

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-42469
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42469.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-42469
Aliases
Published
2024-08-09T18:12:11.502Z
Modified
2026-02-13T16:32:30.573045Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
CometVisu Backend for openHAB affected by RCE through path traversal
Details

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, CometVisu's file system endpoints don't require authentication and additionally the endpoint to update an existing file is susceptible to path traversal. This makes it possible for an attacker to overwrite existing files on the openHAB instance. If the overwritten file is a shell script that is executed at a later time, this vulnerability can allow remote code execution by an attacker. Users should upgrade to version 4.2.1 to receive a patch.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42469.json"
}
References

Affected packages

Git / github.com/openhab/openhab-webui

Affected ranges

Type
GIT
Repo
https://github.com/openhab/openhab-webui
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c5aa5c6446d53e7f6298a5483914928f7eb35786

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42469.json"