CVE-2024-42468

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4.2.1 is susceptible to an unauthenticated path traversal vulnerability. Local files on the server can be requested via HTTP GET on the CometVisuServlet. This issue may lead to information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Aug 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-424699.8openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.CVE-2024-42478.8A vulnerability has been found in Tenda i21 1.0.0.14(4656) and classified as critical. This vulnerability affects the function formQosManage CVE-2024-424709.1openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in CVE-2024-424717.5actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vul CVE-2024-4247210.0Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatp CVE-2024-424739.8OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with CVE-2024-424746.5Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerabilit CVE-2024-424756.5In the OAuth library for nim prior to version 0.11, the `state` values generated by the `generateState` function do not have sufficient entr CVE-2024-424766.5In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the `state` parameter to pr CVE-2024-424777.5llama.cpp provides LLM inference in C/C++. The unsafe `type` member in the `rpc_tensor` structure can cause `global-buffer-overflow`. This v CVE-2024-424789.8llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause arbitrary address readin CVE-2024-424799.8llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause arbitrary address writin