GHSA-4xqv-47rm-37mmMediumCVSS 5.9

OpenC3 stores passwords in clear text (`GHSL-2024-129`)

Published
October 2, 2024
Last Modified
November 13, 2024

🔗 CVE IDs covered (1)

CVE-2024-47529 →

📋 Description

Summary

OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128).

Note: This CVE only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition

Impact

This issue may lead to Information Disclosure.

🎯 Affected products3

  • rubygems/openc3:< 5.19.0
  • npm/@openc3/tool-common:< 5.19.0
  • pip/openc3:>= 0, < 5.19.0

🔗 References (6)