GHSA-vfj8-5pj7-2f9gMediumCVSS 6.1

OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)

Published
October 2, 2024
Last Modified
October 31, 2024

🔗 CVE IDs covered (1)

CVE-2024-43795 →

📋 Description

Summary

The login functionality contains a reflected cross-site scripting (XSS) vulnerability.

Note: This CVE only affects Open Source Edition, and not OpenC3 COSMOS Enterprise Edition

Impact

This issue may lead up to Remote Code Execution (RCE).

🎯 Affected products3

  • rubygems/openc3:< 5.19.0
  • npm/@openc3/tool-common:< 5.19.0
  • pip/openc3:< 5.19.0

🔗 References (7)