CVE-2021-47942: Home Assistant Community Store 1.10.0 Path Traversal Account Takeover
Home Assistant Community Store (HACS) prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint. Attackers can retrieve the .storage/auth file containing user credentials and refresh tokens, then craft valid JWT tokens to gain administrative access to Home Assistant instances.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47942?
CVE-2021-47942 has a high severity due to the potential for unauthorized access to sensitive files.
How do I fix CVE-2021-47942?
To fix CVE-2021-47942, it is recommended to upgrade to a version of Home Assistant Community Store that is higher than 1.10.0.
What type of vulnerability is CVE-2021-47942?
CVE-2021-47942 is classified as a Path Traversal vulnerability.
Who is affected by CVE-2021-47942?
Users of Home Assistant Community Store version 1.10.0 are affected by CVE-2021-47942.
Can CVE-2021-47942 allow remote access?
Yes, CVE-2021-47942 can allow unauthenticated attackers to read sensitive files remotely.