Vulnerability Description
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openhab | Openhab | < 4.2.1 |
Related Weaknesses (CWE)
References
- https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92Patch
- https://github.com/openhab/openhab-webui/security/advisories/GHSA-3g4c-hjhr-73rjVendor Advisory
FAQ
What is CVE-2024-42470?
CVE-2024-42470 is a vulnerability with a CVSS score of 6.5 (MEDIUM). openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB d...
How severe is CVE-2024-42470?
CVE-2024-42470 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-42470?
Check the references section above for vendor advisories and patch information. Affected products include: Openhab Openhab.