openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NOpenhab
APPOpenhab< 4.2.1
Powiązane podatności
openHAB CometVisu: path traversal umożliwiający RCE bez uwierzytelnienia
openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformat...
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on Co...
openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before v...
openHAB CometVisu: SSRF i XSS prowadzące do RCE bez uwierzytelnienia