Vendor
openremote
20 known vulnerabilities.
Products
10 results · Clear filters · Feed
-
High 8.0
OpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global Resources
OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /co…
-
High 7.2
OpenRemote has authenticated SQL injection in crosstab datapoint exports
OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV crosstab` SQL by concatenating an `asset name` and `attribute name` into a `COPY` query that uses `crosstab` and streams `TO STDOUT`. The `as…
-
High 8.5
OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to t…
-
High 7.7
OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role wit…
-
High 7.6
OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP …
-
High 7.7
OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin c…
-
High 7.2
OpenRemote < 1.26.0 SQL Injection via Crosstab Export
OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rena…
-
High 8.1
OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint
OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The remove…
-
High 7.6
OpenRemote has XXE in Velbus Asset Import
OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit XXE hardening. An authenticated user who can call the import endpoint may trigger XML external enti…
-
High 7.0
OpenRemote has Improper Access Control via updateUserRealmRoles function
OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin` in one Keycloak realm can call the Manager API to update Keycloak realm roles for users in another realm, including `master`. The handler uses the …