CVE-2024-42468CWE-22

Path traversal (CometVisu)

Medium · published August 9, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4.2.1 is susceptible to an unauthenticated path traversal vulnerability. Local files on the server can be requested via HTTP GET on the CometVisuServlet. This issue may lead to information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00808 · 56.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-08-09T18:10Z
EPSS history
Timeline
  • 09 AUG 18:10Z
    Path traversal (CometVisu)
    cvelistv5