Vulnerability · Published Jul 10, 2024 · Assigned by @huntr_ai
CVE-2024-6433Local File Inclusion in stitionai/devika
High 7.5
In plain English
A high-severity security flaw in stitionai/devika from stitionai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.0)7.5High
Exploit odds (30 days)0.6%top 53.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The application zips all the files in the folder specified by the user, which allows an attacker to read arbitrary files on the system by providing a crafted path. This vulnerability can be exploited by sending a request to the application with a malicious snapshot_path parameter.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| stitionai | stitionai/devika | unspecified – before - |
Weakness: CWE-23 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N