CVE-2024-43795 — OpenC3 Cross-site Scripting in...

MEDIUM

OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)

Published October 2, 2024Updated October 31, 2024Source: osv

Summary

### Summary The login functionality contains a reflected cross-site scripting (XSS) vulnerability. Note: This CVE only affects Open Source Edition, and not OpenC3 COSMOS Enterprise Edition ### Impact This issue may lead up to Remote Code Execution (RCE).

Advisory Timeline

First published October 2, 2024 (740 days ago).
Last revised October 31, 2024 — 29 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm

Update @openc3/tool-common to 5.19.0 or later

npm install @openc3/tool-common@5.19.0

pip

Update openc3 to 5.19.0 or later

pip install "openc3>=5.19.0"

Bundler

Update openc3 to 5.19.0 or later

gem install openc3 -v 5.19.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 3 ecosystems: npm (1), pypi (1), rubygems (1).

Package	Ecosystem	Affected	Fixed In
@openc3/tool-common	npm	All versions	5.19.0
openc3	pypi	0.1.0, 5.10.0, 5.10.1, 5.11.0 (+18 more)	5.19.0
openc3	rubygems	5.0.10, 5.0.11, 5.0.6, 5.0.7 (+43 more)	5.19.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-79
Cross-site Scripting (XSS)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.1 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Frequently Asked Questions

What is CVE-2024-43795?: OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`) This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.1/10).
How do I check if my project is affected by CVE-2024-43795?: CVE-2024-43795 affects @openc3/tool-common and openc3. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-43795 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

6.1

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-vfj8-5pj7-2f9g

PYSEC-2024-100

Related CVEs

CVE-2026-77602
CRITICAL
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
CVE-2026-42087
CRITICAL
OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database
CVE-2025-68271
CRITICAL
openc3-api Vulnerable to Unauthenticated Remote Code Execution
CVE-2024-46977
HIGH
OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)
CVE-2026-77601
HIGH
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting
CVE-2026-42084
HIGH
OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence
CVE-2024-47529
MEDIUM
OpenC3 stores passwords in clear text (`GHSL-2024-129`)
CVE-2026-42086
MEDIUM
OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies