Medium severity6.5NVD Advisory· Published Aug 12, 2024· Updated Jun 17, 2026

CVE-2024-42470

Description

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.openhab.ui.bundles:org.openhab.ui.cometvisuMaven	< 4.2.1	4.2.1

Affected products

ghsa-coords
pkg:maven/org.openhab.ui.bundles/org.openhab.ui.cometvisu
Range: < 4.2.1
Openhab/Openhab Webuiv5
Range: < 4.2.1

Patches

Vulnerability mechanics

References

github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2nvdPatchWEB
github.com/advisories/GHSA-3g4c-hjhr-73rjghsaADVISORY
github.com/openhab/openhab-webui/security/advisories/GHSA-3g4c-hjhr-73rjnvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2024-42470ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000