THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Fathom (Privacy friendly web analytics)
Zendesk (Helpdesk and Chat)

Ok

Home | EN
Support
CVE
PUBLISHED

CVE-2024-5926

Path Traversal in stitionai/devika

Assigner@huntr_ai
Reserved2024-06-12
Published2024-06-30
Updated2024-07-12

Description

A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service (DoS). This issue is present in all versions of the application. The vulnerability arises due to insufficient path sanitization for the 'project-name' parameter, enabling attackers to specify paths that traverse the filesystem. By setting 'project-name' to the root directory, an attacker can cause the application to attempt to read the entire filesystem, leading to a DoS condition.



CRITICAL: 9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Problem types

CWE-29 Path Traversal: '\..\filename'

Product status

Any version before -
affected

References

https://huntr.com/bounties/19af24fe-9b90-4638-8fbc-b18def6985d7

cve.org CVE-2024-5926

nvd.nist.gov CVE-2024-5926

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-5926
© Copyright 2024 THREATINT. Made in Cyprus with +