CVE-2024-47529 - CVE House
Back to Database
Status published Medium CVE-2024-47529

OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)

Vulnerability Description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128). This vulnerability is fixed in 5.19.0. This only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47529

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenC3

View All →
CVE-2025-68271
Unauthenticated Remote Code Execution in openc3-api
Critical 10
CVE-2024-46977
OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)
Medium 5.3
CVE-2024-43795
OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`)
Medium 5.1

Affected Vendor

Affected Software

cosmos
Vulnerable Versions:
< 5.19.0

Timeline

Official Publish: October 2nd, 2024
Last Modified: October 31st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-312

MITRE ATT&CK TTPs

T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1530 Data from Cloud Storage
Collection
T1078 Valid Accounts
Persistence
T1041 Exfiltration Over C2 Channel
Exfiltration