Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS12Zmo4LTVwajctMmY5Z84AA_7P
OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)
Summary
The login functionality contains a reflected cross-site scripting (XSS) vulnerability.
Note: This CVE only affects Open Source Edition, and not OpenC3 COSMOS Enterprise Edition
Impact
This issue may lead up to Remote Code Execution (RCE).
Permalink: https://github.com/advisories/GHSA-vfj8-5pj7-2f9gJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12Zmo4LTVwajctMmY5Z84AA_7P
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 16 days ago
Updated: 4 days ago
CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-vfj8-5pj7-2f9g, CVE-2024-43795
References:
- https://github.com/OpenC3/cosmos/security/advisories/GHSA-vfj8-5pj7-2f9g
- https://github.com/OpenC3/cosmos/commit/762d7e0e93bdc2f340b1e42acccedc78994a576e
- https://nvd.nist.gov/vuln/detail/CVE-2024-43795
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/openc3/CVE-2024-43795.yml
- https://github.com/pypa/advisory-database/tree/main/vulns/openc3/PYSEC-2024-100.yaml
- https://github.com/advisories/GHSA-vfj8-5pj7-2f9g
Blast Radius: 1.0
Affected Packages
pypi:openc3
Dependent packages: 0Dependent repositories: 0
Downloads: 2,477 last month
Affected Version Ranges: < 5.19.0
Fixed in: 5.19.0
All affected versions: 0.1.0, 5.10.0, 5.10.1, 5.11.0, 5.11.1, 5.11.2, 5.11.3, 5.12.0, 5.13.0, 5.14.0, 5.14.1, 5.14.2, 5.15.0, 5.15.1, 5.15.2, 5.16.0, 5.16.1, 5.16.2, 5.17.0, 5.17.1, 5.18.0
All unaffected versions: 5.19.0
npm:@openc3/tool-common
Dependent packages: 1Dependent repositories: 1
Downloads: 672 last month
Affected Version Ranges: < 5.19.0
Fixed in: 5.19.0
All affected versions: 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.1.0, 5.1.1, 5.2.0, 5.3.0, 5.4.0, 5.4.1, 5.4.2, 5.5.0, 5.5.1, 5.5.2, 5.6.0, 5.6.1, 5.7.0, 5.7.2, 5.8.0, 5.8.1, 5.9.0, 5.9.1, 5.10.0, 5.10.1, 5.11.0, 5.11.1, 5.11.2, 5.11.3, 5.12.0, 5.13.0, 5.14.0, 5.14.1, 5.14.2, 5.15.0, 5.15.1, 5.15.2, 5.16.0, 5.16.1, 5.16.2, 5.17.0, 5.17.1, 5.18.0
All unaffected versions: 5.19.0
rubygems:openc3
Dependent packages: 0Dependent repositories: 1
Downloads: 20,300 total
Affected Version Ranges: < 5.19.0
Fixed in: 5.19.0
All affected versions: 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.1.0, 5.1.1, 5.2.0, 5.3.0, 5.4.0, 5.4.1, 5.4.2, 5.5.0, 5.5.1, 5.5.2, 5.6.0, 5.6.1, 5.7.0, 5.7.2, 5.8.0, 5.8.1, 5.9.0, 5.9.1, 5.10.0, 5.10.1, 5.11.0, 5.11.1, 5.11.2, 5.11.3, 5.12.0, 5.13.0, 5.14.0, 5.14.1, 5.14.2, 5.15.0, 5.15.1, 5.15.2, 5.16.0, 5.16.1, 5.16.2, 5.17.0, 5.17.1, 5.18.0
All unaffected versions: 5.19.0