CVE-2024-46977

Description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's open_local_file method allows an authenticated user with adequate permissions to download any .txt via the ScreensController#show on the web server COSMOS is running on (depending on the file permissions). This vulnerability is fixed in 5.19.0.

Reserved 2024-09-16 | Published 2024-10-02 | Updated 2024-10-31 | Assigner GitHub_M

Problem types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

< 5.19.0
affected

References

github.com/...cosmos/security/advisories/GHSA-8jxr-mccc-mwg8

github.com/...ommit/a34e61aea5a465f0ab3e57d833ae7ff4cafd710b

securitylab.github.com/...24-127_GHSL-2024-129_OpenC3_COSMOS

cve.org (CVE-2024-46977)

nvd.nist.gov (CVE-2024-46977)

Download JSON