OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)
Description
Published to the GitHub Advisory Database
Oct 2, 2024
Reviewed
Oct 2, 2024
Published by the National Vulnerability Database
Oct 2, 2024
Last updated
Oct 16, 2024
Summary
A path traversal vulnerability inside of
LocalMode
'sopen_local_file
method allows an authenticated user with adequate permissions to download any.txt
via theScreensController#show
on the web server COSMOS is running on (depending on the file permissions).Note: This CVE affects all OpenC3 COSMOS Editions
Impact
This issue may lead to Information Disclosure.
References