Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS00eHF2LTQ3cm0tMzdtbc4AA_7R

OpenC3 stores passwords in clear text (`GHSL-2024-129`)

Summary

OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128).

Note: This CVE only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition

Impact

This issue may lead to Information Disclosure.

Permalink: https://github.com/advisories/GHSA-4xqv-47rm-37mm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00eHF2LTQ3cm0tMzdtbc4AA_7R
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 months ago
Updated: 7 days ago


CVSS Score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-4xqv-47rm-37mm, CVE-2024-47529
References: Repository: https://github.com/OpenC3/cosmos
Blast Radius: 1.0

Affected Packages

pypi:openc3
Dependent packages: 0
Dependent repositories: 0
Downloads: 1,491 last month
Affected Version Ranges: >= 0, < 5.19.0
Fixed in: 5.19.0
All affected versions: 0.1.0, 5.10.0, 5.10.1, 5.11.0, 5.11.1, 5.11.2, 5.11.3, 5.12.0, 5.13.0, 5.14.0, 5.14.1, 5.14.2, 5.15.0, 5.15.1, 5.15.2, 5.16.0, 5.16.1, 5.16.2, 5.17.0, 5.17.1, 5.18.0
All unaffected versions: 5.19.0, 5.20.0
npm:@openc3/tool-common
Dependent packages: 1
Dependent repositories: 1
Downloads: 867 last month
Affected Version Ranges: < 5.19.0
Fixed in: 5.19.0
All affected versions: 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.1.0, 5.1.1, 5.2.0, 5.3.0, 5.4.0, 5.4.1, 5.4.2, 5.5.0, 5.5.1, 5.5.2, 5.6.0, 5.6.1, 5.7.0, 5.7.2, 5.8.0, 5.8.1, 5.9.0, 5.9.1, 5.10.0, 5.10.1, 5.11.0, 5.11.1, 5.11.2, 5.11.3, 5.12.0, 5.13.0, 5.14.0, 5.14.1, 5.14.2, 5.15.0, 5.15.1, 5.15.2, 5.16.0, 5.16.1, 5.16.2, 5.17.0, 5.17.1, 5.18.0
All unaffected versions: 5.19.0, 5.20.0
rubygems:openc3
Dependent packages: 0
Dependent repositories: 1
Downloads: 21,948 total
Affected Version Ranges: < 5.19.0
Fixed in: 5.19.0
All affected versions: 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.1.0, 5.1.1, 5.2.0, 5.3.0, 5.4.0, 5.4.1, 5.4.2, 5.5.0, 5.5.1, 5.5.2, 5.6.0, 5.6.1, 5.7.0, 5.7.2, 5.8.0, 5.8.1, 5.9.0, 5.9.1, 5.10.0, 5.10.1, 5.11.0, 5.11.1, 5.11.2, 5.11.3, 5.12.0, 5.13.0, 5.14.0, 5.14.1, 5.14.2, 5.15.0, 5.15.1, 5.15.2, 5.16.0, 5.16.1, 5.16.2, 5.17.0, 5.17.1, 5.18.0
All unaffected versions: 5.19.0, 5.20.0