CVE-2024-12048

Katalog CVE

CVSS 8.8 · High EPSS 0,74%

Kerentanan Missing Critical Step in Authentication pada superagi. Skor CVSS 3.0 8.8 (High) menurut huntr.dev.

Deskripsi (NVD)

An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.0

8.8 (High), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-304: Missing Critical Step in Authentication
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/6def3e3a-c443-44bb-b20e-3e69b48f37dc exploit · advisory pihak ketiga