Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-4xqv-47rm-37mm: OpenC3 stores passwords in clear text (`GHSL-2024-129`)

Summary

OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128).

Note: This CVE only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition

Impact

This issue may lead to Information Disclosure.

NOTE: The complete advisory with much more information is added as comment.

ghsa
#xss#web#nodejs#git
  1. GitHub Advisory Database
  2. GitHub Reviewed
  3. CVE-2024-47529

OpenC3 stores passwords in clear text (`GHSL-2024-129`)

Moderate severity GitHub Reviewed Published Oct 2, 2024 in OpenC3/cosmos • Updated Oct 2, 2024

Package

npm @openc3/tool-common (npm)

Affected versions

< 5.19.0

Summary

OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128).

Note: This CVE only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition

Impact

This issue may lead to Information Disclosure.

NOTE: The complete advisory with much more information is added as comment.

References

  • GHSA-4xqv-47rm-37mm
  • OpenC3/cosmos@b5ab34f

Published to the GitHub Advisory Database

Oct 2, 2024

ghsa: Latest News

GHSA-6jrf-rcjf-245r: changedetection.io path traversal using file URI scheme without supplying hostname