PT-2024-32642 · Openc3 · Openc3 Cosmos

P- · Published 2024-10-02 · Updated 2024-11-18 · CVE-2024-47529

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions prior to 5.19.0

Description OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting. The issue may lead to Information Disclosure. This only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition.

Recommendations For versions prior to 5.19.0, update to version 5.19.0 to resolve the issue. As a temporary workaround, consider clearing the LocalStorage of the web browser to minimize the risk of password exfiltration. Restrict access to sensitive data and embedded systems until the update is applied.

Exploit

Fix

Cleartext Storage of Sensitive Information

Insufficiently Protected Credentials

Weakness Enumeration

CWE-312

CWE-522

Related Identifiers

CVE-2024-47529

GHSA-4XQV-47RM-37MM

PYSEC-2024-121

Affected Products

Openc3 Cosmos

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47529.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-127_GHSL-2024-129_OpenC3_COSMOS · Exploit
• https://github.com/OpenC3/cosmos/commit/b5ab34fe7fa54c0c8171c4aa3caf4e03d6f63bd7 · Patch
• https://github.com/OpenC3/cosmos/security/advisories/GHSA-4xqv-47rm-37mm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47529 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47529 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-121 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4xqv-47rm-37mm · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/openc3/PYSEC-2024-121.yaml · Note
• https://github.com/OpenC3/cosmos · Note
• https://twitter.com/SpaceCyberSec/status/1858329495327146010 · Twitter Post
• https://t.me/cvedetector/6875 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1841612678319489106 · Twitter Post
• https://twitter.com/GHSecurityLab/status/1847101545516536134 · Twitter Post
• https://twitter.com/CVEnew/status/1841560208155328775 · Twitter Post