CVE-2024-42468

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4.2.1 is susceptible to an unauthenticated path traversal vulnerability. Local files on the server can be requested via HTTP GET on the CometVisuServlet. This issue may lead to information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.

• CWE-22
• CWE-22

• https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/servlet/CometVisuServlet.java#L75Patch
• https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2Patch
• https://github.com/openhab/openhab-webui/security/advisories/GHSA-pcwp-26pw-j98wVendor Advisory

Published

Aug 12, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42462Improper Authentication vulnerability in upKeeper Solutions …9.8
• CVE-2024-42463Authorization Bypass Through User-Controlled Key vulnerabili…6.5
• CVE-2024-42464Authorization Bypass Through User-Controlled Key vulnerabili…6.5
• CVE-2024-42465Improper Restriction of Excessive Authentication Attempts vu…9.8
• CVE-2024-42466Improper Restriction of Excessive Authentication Attempts vu…9.8
• CVE-2024-42467openHAB, a provider of open-source home automation software,…10
• CVE-2024-42469openHAB, a provider of open-source home automation software,…9.8
• CVE-2024-4247A vulnerability has been found in Tenda i21 1.0.0.14(4656) a…8.8
• CVE-2024-42470openHAB, a provider of open-source home automation software,…9.1
• CVE-2024-42471actions/artifact is the GitHub ToolKit for developing GitHub…7.5
• CVE-2024-42472Flatpak is a Linux application sandboxing and distribution f…10
• CVE-2024-42473OpenFGA is an authorization/permission engine. OpenFGA v1.5.…9.8