CVSS 4.0
5.1 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NCVE-2024-43795
Medium (5.1) in openc3 cosmos. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in openc3 5.19.0.
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a reflected cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 5.19.0. Note: This CVE only affects Open Source Edition, and not OpenC3 COSMOS Enterprise Edition.
Severity
CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openc3:cosmos
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vfj8-5pj7-2f9g | RubyGems | openc3 | <5.19.0 | 5.19.0 |
| GHSA-vfj8-5pj7-2f9g | npm | @openc3/tool-common | <5.19.0 | 5.19.0 |
| GHSA-vfj8-5pj7-2f9g | PyPI | openc3 | <5.19.0 | 5.19.0 |
| PYSEC-2024-100 | PyPI | openc3 | <5.19.0 | 5.19.0 |