diff --git a/advisories/github-reviewed/2024/10/GHSA-8jxr-mccc-mwg8/GHSA-8jxr-mccc-mwg8.json b/advisories/github-reviewed/2024/10/GHSA-8jxr-mccc-mwg8/GHSA-8jxr-mccc-mwg8.json index 6ae6becc8d2..3d8ce42e590 100644 --- a/advisories/github-reviewed/2024/10/GHSA-8jxr-mccc-mwg8/GHSA-8jxr-mccc-mwg8.json +++ b/advisories/github-reviewed/2024/10/GHSA-8jxr-mccc-mwg8/GHSA-8jxr-mccc-mwg8.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-8jxr-mccc-mwg8", - "modified": "2024-10-09T18:32:27Z", + "modified": "2024-10-16T13:44:11Z", "published": "2024-10-02T19:29:32Z", "aliases": [ "CVE-2024-46977" ], "summary": "OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)", - "details": "### Summary\nA path traversal vulnerability inside of `LocalMode`'s `open_local_file` method allows an authenticated user with adequate permissions to download any `.txt` via the `ScreensController#show` on the web server COSMOS is running on (depending on the file permissions).\n\nNote: This CVE affects all OpenC3 COSMOS Editions\n\n### Impact\nThis issue may lead to Information Disclosure.\n\n**NOTE:** The complete advisory with much more information is added as [comment](https://github.com/OpenC3/cosmos/security/advisories/GHSA-8jxr-mccc-mwg8#advisory-comment-104903).", + "details": "### Summary\nA path traversal vulnerability inside of `LocalMode`'s `open_local_file` method allows an authenticated user with adequate permissions to download any `.txt` via the `ScreensController#show` on the web server COSMOS is running on (depending on the file permissions).\n\nNote: This CVE affects all OpenC3 COSMOS Editions\n\n### Impact\nThis issue may lead to Information Disclosure.\n", "severity": [ { "type": "CVSS_V3",