CVE-2024-42467
The CometVisu add‑on for openHAB had a proxy endpoint that could be accessed without authentication. This flaw allows attackers to perform server‑side request forgery (SSRF) and cross‑site scripting (XSS), potentially leading to remote code execution. The issue affects add‑on versions 3.4.0.M4 through 4.2.0 and is fixed in version 4.2.1.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
openHAB CometVisu add‑on (openhab_web_interface) versions 3.4.0.M4 through 4.2.0
Real-world impact
An attacker can make the openHAB server send requests to internal services or inject malicious JavaScript that runs with the UI’s origin, enabling them to call openHAB endpoints or, when combined with other flaws, execute arbitrary code.
Why this severity
The CVSS score of 10 reflects that the vulnerability requires no authentication, no user interaction, and gives attackers full confidentiality and integrity impact, with the possibility of remote code execution.
What to do about it
- 01Upgrade the CometVisu add‑on to version 4.2.1 or later.
NVD-referenced vendor advisory
Timeline
- Aug 12, 2024 · Aug 12, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 5, 2026 · 11h agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 6h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.