CVE-2024-42470

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-42470
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42470.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-42470
Aliases
Published
2024-08-09T18:02:12.061Z
Modified
2026-04-10T05:16:05.983198Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
CometVisu Backend for openHAB has a sensitive information disclosure vulnerability
Details

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42470.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/openhab/openhab-addons

Affected ranges

Type
GIT
Repo
https://github.com/openhab/openhab-addons
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d18df74c4b16c63a914845938b49e8ff597a40f2
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.2.1"
        }
    ]
}

Affected versions

4.*
4.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42470.json"

Git / github.com/openhab/openhab-webui

Affected ranges

Type
GIT
Repo
https://github.com/openhab/openhab-webui
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c5aa5c6446d53e7f6298a5483914928f7eb35786

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42470.json"