CVE-2024-46977

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-46977

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-46977.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-46977

Aliases

Published

2024-10-02T19:17:14.049Z

Modified

2026-07-15T01:49:13.025527036Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)

Details

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's openlocalfile method allows an authenticated user with adequate permissions to download any .txt via the ScreensController#show on the web server COSMOS is running on (depending on the file permissions). This vulnerability is fixed in 5.19.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46977.json"
}

References

Affected packages

Git / github.com/openc3/cosmos

Affected ranges

Type

GIT

Repo

https://github.com/openc3/cosmos

Events

Introduced

Fixed

fa395189069aee7697f67e1739bc37c56fcc3e6d

Fixed

a34e61aea5a465f0ab3e57d833ae7ff4cafd710b

Database specific

{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": [
        "cpe:2.3:a:openc3:cosmos:*:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:openc3:cosmos:*:*:*:*:open_source:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.19.0"
        }
    ]
}

Affected versions

v3.*

v3.0.0

v3.1.0

v3.1.1

v3.1.2

v3.2.1

v3.3.0

v3.3.1

v3.4.0

v3.4.1

v3.4.2

v3.5.1

v3.6.0

v3.6.1

v3.6.2

v3.7.0

v3.8.0

v3.8.1

v3.8.2

v3.8.3

v3.9.0

v3.9.1

v3.9.2

v4.*

v4.0.0

v4.0.1

v4.0.2

v4.0.3

v4.1.0

v4.1.1

v4.2.3

v4.3.0

v5.*

v5.0.0

v5.0.0-beta.1

v5.0.0.beta2

v5.0.1

v5.0.10

v5.0.11

v5.0.2

v5.0.3

v5.0.4

v5.0.5

v5.0.7

v5.0.8

v5.0.9

v5.1.0

v5.1.1

v5.10.0

v5.10.1

v5.11.0

v5.11.1

v5.11.2

v5.11.3

v5.12.0

v5.13.0

v5.14.0

v5.14.1

v5.14.2

v5.15.0

v5.15.1

v5.15.2

v5.16.0

v5.16.1

v5.16.2

v5.17.0

v5.17.1

v5.18.0

v5.2.0

v5.3.0

v5.4.0

v5.4.1

v5.4.2

v5.4.3-beta0

v5.5.0

v5.5.0-beta0

v5.5.1

v5.5.2

v5.5.2-beta0

v5.6.0

v5.6.1

v5.7.0

v5.7.2

v5.8.0

v5.8.1

v5.9.0

v5.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-46977.json"