CVE-2024-42470 CometVisu Backend for openHAB has a sensitive information disclosure vulnerability

What is CVE-2024-42470?

CVE-2024-42470 is a medium-severity missing authorization vulnerability in openhab-webui, published on 9 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.

Weakness: CWE-862

Which versions are affected by CVE-2024-42470?

2 open source packages ship an affected version, including org.openhab.ui.bundles:org.openhab.ui.cometvisu. It affects 1 product.

Products include Openhab Openhab.

How do I fix CVE-2024-42470?

Upgrade org.openhab.ui.bundles:org.openhab.ui.cometvisu to 4.2.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-42470 being exploited?

There is no known exploitation of CVE-2024-42470 in the wild and no public exploit code.

Other vulnerabilities in openhab-webui

• CVE-2024-42469 CometVisu Backend for openHAB affected by RCE through path traversal Critical 9.8
• CVE-2020-5242 openHAB exec add-ons allow remote arbitrary command execution High 7.7
• CVE-2021-21266 XXE vulnerability in OpenHAB Medium 6.4
• CVE-2024-42468 Path traversal (CometVisu) Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3g4c-hjhr-73rj.