Vulnerability · Published Aug 14, 2024 · Assigned by tenable

CVE-2024-7790DevikaAI Stored Cross-Site Scripting

Medium 6.5

In plain English

A medium-severity cross-site scripting in DevikaAI from Devikia. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 72.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A stored cross site scripting vulnerabilities exists in DevikaAI from commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2 onwards via improperly decoded user input.

Affected products (as reported)

Vendor	Product	Versions
Devikia	DevikaAI	6acce21fb08c3d1123ef05df6a33912bf0ee77c2 – through current

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://www.tenable.com/security/research/tra-2024-31