CVE-2024-6433
Local File Inclusion in stitionai/devika
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7.5EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
10 Jul 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The application zips all the files in the folder specified by the user, which allows an attacker to read arbitrary files on the system by providing a crafted path. This vulnerability can be exploited by sending a request to the application with a malicious snapshot_path parameter.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
stitionai · stitionai/devikaWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →