CVE-2024-47529

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions prior to 5.19.0

Description OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting. The issue may lead to Information Disclosure. This only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition.

Recommendations For versions prior to 5.19.0, update to version 5.19.0 to resolve the issue. As a temporary workaround, consider clearing the LocalStorage of the web browser to minimize the risk of password exfiltration. Restrict access to sensitive data and embedded systems until the update is applied.