Vulnerability · Published Jun 30, 2024 · Assigned by @huntr_ai
CVE-2024-5926Path Traversal in stitionai/devika
Critical 9.1
In plain English
A critical-severity security flaw in stitionai/devika from stitionai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Official description
A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service (DoS). This issue is present in all versions of the application. The vulnerability arises due to insufficient path sanitization for the 'project-name' parameter, enabling attackers to specify paths that traverse the filesystem. By setting 'project-name' to the root directory, an attacker can cause the application to attempt to read the entire filesystem, leading to a DoS condition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| stitionai | stitionai/devika | unspecified – before - |
Weakness: CWE-29 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H