What is CVE-2024-43795?

CVE-2024-43795 is a vulnerability in Openc3 Cosmos, classified under Cross-site Scripting. Published 2024-10-02.

Is CVE-2024-43795 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Openc3 Cosmos

CVE-2024-43795

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a reflected cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 5…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.015 (81.6th percentile) — read the EPSS interpretation.

Affected products

Openc3 Cosmos — versions < 5.19.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

https://github.com/OpenC3/cosmos/security/advisories/GHSA-vfj8-5pj7-2f9g (x_refsource_CONFIRM)
https://github.com/OpenC3/cosmos/commit/762d7e0e93bdc2f340b1e42acccedc78994a576e (x_refsource_MISC)
https://securitylab.github.com/advisories/GHSL-2024-127_GHSL-2024-129_OpenC3_COSMOS (x_refsource_MISC)

Frequently asked questions

What is CVE-2024-43795?: CVE-2024-43795 is a vulnerability in Openc3 Cosmos, classified under Cross-site Scripting. Published 2024-10-02.
Is CVE-2024-43795 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.