ADVISORIES

• CVE-2024-43795 (NVD)
• GHSA-vfj8-5pj7-2f9g
• Vendor Advisory

GEM

openc3

SEVERITY

CVSS v3.x: 6.1 (Medium)

PATCHED VERSIONS

• >= 5.19.0

DESCRIPTION

Summary

The login functionality contains a reflected cross-site scripting (XSS) vulnerability.

Note: This CVE only affects Open Source Edition, and not OpenC3 COSMOS Enterprise Edition

Impact

This issue may lead up to Remote Code Execution (RCE).

NOTE: The complete advisory with much more information is added as comment.

RELATED

• https://nvd.nist.gov/vuln/detail/CVE-2024-43795
• https://github.com/OpenC3/cosmos/security/advisories/GHSA-vfj8-5pj7-2f9g
• https://github.com/OpenC3/cosmos/commit/762d7e0e93bdc2f340b1e42acccedc78994a576e
• https://github.com/advisories/GHSA-vfj8-5pj7-2f9g