GHSA-3g4c-hjhr-73rj

CometVisu Backend for openHAB has a sensitive information disclosure vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-42470

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.openhab.ui.bundles:org.openhab.ui.cometvisu	< 4.2.1	4.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

Several endpoints in the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. ## Impact This issue may lead to sensitive Information Disclosure.

References

External links from the advisory. They lead to third-party sites.

https://github.com/openhab/openhab-webui/security/advisories/GHSA-3g4c-hjhr-73rj web
https://nvd.nist.gov/vuln/detail/CVE-2024-42470 advisory
https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2 web
https://github.com/openhab/openhab-webui package