Publish Advisories

GHSA-f729-58x4-gqgf GHSA-pcwp-26pw-j98w
2026-05-22 18:04:22 -07:00 · 2024-08-09 18:25:32 +00:00
parent a11a1ae400
commit 2b765b6e14
2 changed files with 140 additions and 0 deletions
@@ -0,0 +1,68 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f729-58x4-gqgf",
+  "modified": "2024-08-09T18:24:07Z",
+  "published": "2024-08-09T18:24:07Z",
+  "aliases": [
+    "CVE-2024-42469"
+  ],
+  "summary": "CometVisu Backend for openHAB affected by RCE through path traversal",
+  "details": "CometVisu's file system endpoints don't require authentication and additionally the endpoint to update an existing file is susceptible to path traversal. This makes it possible for an attacker to overwrite existing files on the openHAB instance. If the overwritten file is a shell script that is executed at a later time this vulnerability can allow remote code execution by an attacker.\n\nThis vulnerability was discovered with the help of CodeQL's [Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/java/java-path-injection/) query.\n\n## Impact\n\nThis issue may lead up to Remote Code Execution (RCE).",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.openhab.ui.bundles:org.openhab.ui.cometvisu"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "4.2.1"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 4.2.0"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/openhab/openhab-webui/security/advisories/GHSA-f729-58x4-gqgf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/openhab/openhab-webui"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-08-09T18:24:07Z",
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,72 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pcwp-26pw-j98w",
+  "modified": "2024-08-09T18:24:14Z",
+  "published": "2024-08-09T18:24:14Z",
+  "aliases": [
+    "CVE-2024-42468"
+  ],
+  "summary": "CometVisu Backend for openHAB has a path traversal vulnerability",
+  "details": "openHAB's [CometVisuServlet](https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/servlet/CometVisuServlet.java#L75) is susceptible to an unauthenticated path traversal vulnerability.\n\nLocal files on the server can be requested via HTTP GET on the CometVisuServlet.\n\nThis vulnerability was discovered with the help of CodeQL's [Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/java/java-path-injection/) query.\n\n## Impact\n\nThis issue may lead to Information Disclosure.\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.openhab.ui.bundles:org.openhab.ui.cometvisu"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "4.2.1"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 4.2.0"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/openhab/openhab-webui/security/advisories/GHSA-pcwp-26pw-j98w"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/openhab/openhab-webui"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/servlet/CometVisuServlet.java#L75"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-08-09T18:24:14Z",
+    "nvd_published_at": null
+  }
+}