CVE-2024-46977: falha de média gravidade em OpenC3 cosmos
OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.9%
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's open_local_file method allows an authenticated user with adequate permissions to download any .txt via the ScreensController#show on the web server COSMOS is running on (depending on the file permissions). This vulnerability is fixed in 5.19.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
OpenC3 · cosmosCVEs relacionadas — OpenC3 cosmos
No mesmo produto, das mais perigosas para as menos.
CVE-2026-77602CRITICALOpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)EPSS 0.7%CVE-2025-68271CRITICALUnauthenticated Remote Code Execution in openc3-apiEPSS 0.6%CVE-2026-77601HIGHOpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` settingEPSS 0.6%CVE-2024-43795MEDIUMOpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`)EPSS 0.5%CVE-2026-77394HIGHOpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widgetEPSS 0.4%CVE-2024-47529MEDIUMOpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)EPSS 0.4%