CVE-2024-47529CWE-312

OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)

Medium · published October 2, 2024

CVSS v4.0
4.8
EPSS
0%
Percentile
27.7
In the wild
Unconfirmed
What it is

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128). This vulnerability is fixed in 5.19.0. This only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00353 · 27.7th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2024-10-02T19:17Z
EPSS history
Timeline
  • 02 OCT 19:17Z
    OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)
    cvelistv5