Vulnerability · Published Jun 28, 2024 · Assigned by @huntr_ai

CVE-2024-5712CSRF Vulnerability in stitionai/devika

High 8.1

In plain English

A high-severity cross-site request forgery in stitionai/devika from stitionai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.0)8.1High

Exploit odds (30 days)0.3%top 82.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A Cross-Site Request Forgery (CSRF) vulnerability was identified in the stitionai/devika application, affecting the latest version. This vulnerability allows attackers to perform unauthorized actions in the context of a victim's browser, such as deleting projects or changing application settings, without any CSRF protection implemented. Successful exploitation disrupts the integrity and availability of the application and its data.

Affected products (as reported)

Vendor	Product	Versions
stitionai	stitionai/devika	unspecified – through latest

Weakness: CWE-352 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

References

https://huntr.com/bounties/301aeafb-af28-4b0b-a2cf-9a2ff1da1ef4