Openhab vulnerabilities
We track 4 vulnerabilities in Openhab products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 12, 2024.
Latest Openhab vulnerabilities
- 9.1 Critical severity
openhab-webui: Missing Authorization
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unau
- 9.8 Critical severity
openhab-webui: Improper Limitation of a Pathname to a Restricted Directory
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, CometVisu's file system endpoints don't require authentication and additionally the endpoint to update an existing fi
- 7.5 High severity
openhab-webui: Improper Limitation of a Pathname to a Restricted Directory
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4.2.1 is susceptible to an unauthenticated path traversal vulnerability. Local files on the server can
- 10.0 Critical severity
openhab-webui: Server-Side Request Forgery
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. In versions 3.4.0.M4 through 4.2.0,, the proxy endpoint of openHAB's CometVisu add-on can be accessed without authentication. This proxy-feat