CVE-2024-40422: Devika v1 - Path Traversal via 'snapshot_path'
The snapshotpath parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshotpath parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40422?
CVE-2024-40422 has been classified with a moderate severity level due to its potential for accessing sensitive files through path traversal.
How do I fix CVE-2024-40422?
To fix CVE-2024-40422, validate and sanitize the snapshot_path parameter to prevent directory traversal attacks in stitionai devika v1.0.
Which versions of stitionai devika are affected by CVE-2024-40422?
CVE-2024-40422 affects stitionai devika version 1.0 specifically.
What type of vulnerability is CVE-2024-40422?
CVE-2024-40422 is a path traversal vulnerability that allows attackers to manipulate file paths.
What can attackers do with CVE-2024-40422?
Attackers exploiting CVE-2024-40422 can potentially access sensitive files on the server by traversing directories through the vulnerable parameter.