What is GHSA-3g4c-hjhr-73rj?

GHSA-3g4c-hjhr-73rj is a security advisory published by GitHub Security Advisories with Medium severity. CometVisu Backend for openHAB has a sensitive information disclosure vulnerability

Which CVE IDs does GHSA-3g4c-hjhr-73rj cover?

GHSA-3g4c-hjhr-73rj covers the following CVE IDs: CVE-2024-42470. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3g4c-hjhr-73rj?

GHSA-3g4c-hjhr-73rj has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-3g4c-hjhr-73rj?

GHSA-3g4c-hjhr-73rj affects 1 product, including: maven/org.openhab.ui.bundles:org.openhab.ui.cometvisu:\u003c= 4.2.0.

GHSA-3g4c-hjhr-73rjMediumCVSS 6.5

CometVisu Backend for openHAB has a sensitive information disclosure vulnerability

Vendor

GitHub Security Advisories

Published

August 9, 2024

Last Modified

August 12, 2024

🔗 CVE IDs covered (1)

CVE-2024-42470 →

📋 Description

Several endpoints in the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data.

Impact

This issue may lead to sensitive Information Disclosure.

🎯 Affected products1

maven/org.openhab.ui.bundles:org.openhab.ui.cometvisu:<= 4.2.0

🔗 References (4)

https://github.com/openhab/openhab-webui/security/advisories/GHSA-3g4c-hjhr-73rj
https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2
https://nvd.nist.gov/vuln/detail/CVE-2024-42470
https://github.com/advisories/GHSA-3g4c-hjhr-73rj