CVE-2024-5547: Directory Traversal in stitionai/devika
A directory traversal vulnerability exists in the /api/download-project-pdf endpoint of the stitionai/devika repository, affecting the latest version. The vulnerability arises due to insufficient sanitization of the 'projectname' parameter in the downloadprojectpdf function. Attackers can exploit this flaw by manipulating the 'projectname' parameter in a GET request to traverse the directory structure and download arbitrary PDF files from the system. This issue allows attackers to access sensitive information that could be stored in PDF format outside the intended directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5547?
CVE-2024-5547 is considered a high severity vulnerability due to its potential for unauthorized access to sensitive files.
How do I fix CVE-2024-5547?
To fix CVE-2024-5547, ensure proper sanitization and validation of the 'project_name' parameter in the /api/download-project-pdf endpoint.
Who is affected by CVE-2024-5547?
CVE-2024-5547 affects users of the stitionai/devika repository in its latest version.
What type of vulnerability is CVE-2024-5547?
CVE-2024-5547 is a directory traversal vulnerability that allows attackers to access unauthorized files.
Where can I find more information about CVE-2024-5547?
Details on CVE-2024-5547 can typically be found in security advisories and the official repository of the affected software.