VulnerabilityModified

CVE-2024-43795

The login functionality contains a reflected cross-site scripting (XSS) vulnerability.

MEDIUM 5.1EPSS 0.48%

Does this matter?

Lower severity and a low EPSS score (0.48%). Track it; it rarely justifies an emergency change on its own.

Description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a reflected cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 5.19.0. Note: This CVE only affects Open Source Edition, and not OpenC3 COSMOS Enterprise Edition.

CVSS 4.0: 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.48% probability · 40th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: openc3/cosmos
Source: security-advisories@github.com

References

https://github.com/OpenC3/cosmos/commit/762d7e0e93bdc2f340b1e42acccedc78994a576ePatch
https://github.com/OpenC3/cosmos/security/advisories/GHSA-vfj8-5pj7-2f9gVendor Advisory
https://securitylab.github.com/advisories/GHSL-2024-127_GHSL-2024-129_OpenC3_COSMOS

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.