CVE-2024-40422
critical · 9.1A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.
9.1
CVSS
11.3%
EPSS (exploit prob.)
96th
EPSS percentile
2024-07-24
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-22
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| stitionai | devika | 1.0 |
Check a specific version with /api/v1/cve/match.
References
- https://github.com/alpernae/CVE-2024-40422
- https://github.com/stitionai/devika
- https://github.com/stitionai/devika/pull/619
- https://medium.com/@alpernae/uncovering-path-traversal-in-devika-v1-a-deep-dive-into-cve-2024-40422-f8ce81398b99
- https://github.com/alpernae/CVE-2024-40422
- https://github.com/stitionai/devika
- https://github.com/stitionai/devika/pull/619
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2024-40422