PT-2024-30663

CVE-2024-43795

Published

2024-10-02

Updated

2024-11-18

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS Open Source Edition versions prior to 5.19.0

Description The login functionality of OpenC3 COSMOS contains a reflected cross-site scripting (XSS) vulnerability. This issue may lead to Remote Code Execution (RCE). The vulnerability affects the Open Source Edition, not the OpenC3 COSMOS Enterprise Edition.

Recommendations For OpenC3 COSMOS Open Source Edition versions prior to 5.19.0, update to version 5.19.0 to resolve the issue. As a temporary workaround, consider restricting access to the login functionality until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

P-

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2024-43795