CVE-2024-42470CWE-862

CometVisu Backend for openHAB has a sensitive information disclosure vulnerability

Medium · published August 9, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
43.5
In the wild
Unconfirmed
What it is

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00523 · 43.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-08-09T18:02Z
EPSS history
Timeline
  • 09 AUG 18:02Z
    CometVisu Backend for openHAB has a sensitive information disclosure vulnerability
    cvelistv5