CVE-2024-40422

Katalog CVE

CVSS 9.1 · Critical EPSS 11,4%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada stitionai devika. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.

Rincian

Terbit di NVD

24 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

11,4% peluang dieksploitasi; lebih tinggi dari 95,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/alpernae/CVE-2024-40422 advisory pihak ketiga
• https://github.com/stitionai/devika/pull/619 exploit
• https://github.com/stitionai/devika product
• https://medium.com/@alpernae/uncovering-path-traversal-in-devika-v1-a-deep-dive-into-cve-2024-40422-f8ce81398b...