Headline
GHSA-4xqv-47rm-37mm: OpenC3 stores passwords in clear text (`GHSL-2024-129`)
Summary
OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128).
Note: This CVE only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition
Impact
This issue may lead to Information Disclosure.
NOTE: The complete advisory with much more information is added as comment.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-47529
OpenC3 stores passwords in clear text (`GHSL-2024-129`)
Moderate severity GitHub Reviewed Published Oct 2, 2024 in OpenC3/cosmos • Updated Oct 2, 2024
Package
npm @openc3/tool-common (npm)
Affected versions
< 5.19.0
Summary
OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128).
Note: This CVE only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition
Impact
This issue may lead to Information Disclosure.
NOTE: The complete advisory with much more information is added as comment.
References
- GHSA-4xqv-47rm-37mm
- OpenC3/cosmos@b5ab34f
Published to the GitHub Advisory Database
Oct 2, 2024