Auth bypass in Openhab
CVE-2024-42470
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.
Vulnerability class: Broken Access Control
EPSS: 0.005 (41.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Openhab
- Openhab Openhab-webui — versions < 4.2.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-42470?
- CVE-2024-42470 is a medium-severity vulnerability in Openhab, classified under Missing Authorization. CVSS score: 6.5/10. Published 2024-08-12.
- How severe is CVE-2024-42470?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2024-42470 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.