PT-2024-29967 · Openhab · Cometvisu Add-On+1
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
openHAB CometVisu add-on versions prior to 4.2.1
Description
The issue affects several endpoints in the CometVisu add-on of openHAB that do not require authentication, allowing unauthenticated attackers to modify or steal sensitive data. This may lead to sensitive information disclosure.
Recommendations
For versions prior to 4.2.1 of the CometVisu add-on of openHAB, upgrade to version 4.2.1 to receive a patch. As a temporary workaround, consider restricting access to the affected endpoints until the issue is resolved.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cometvisu Add-On
Openhab