Path Traversal in Openhab
CVE-2024-42468
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4.2.1 is susceptible to an unauthenticated path traversal vulnerability. Local files on the server can be requested via HTTP GET on the CometVisuServlet. This issue may lead to information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.008 (53.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Openhab
- Openhab Openhab-webui — versions < 4.2.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-42468?
- CVE-2024-42468 is a medium-severity vulnerability in Openhab, classified under Path Traversal. CVSS score: 5.3/10. Published 2024-08-12.
- How severe is CVE-2024-42468?
- Medium severity. CVSS v3 base score is 5.3 out of 10.