CVE-2024-9418: Insufficiently Protected Credentials in transformeroptimus/superagi
In version 0.0.14 of transformeroptimus/superagi, the API endpoint /api/users/get/{id} returns the user's password in plaintext. This vulnerability allows an attacker to retrieve the password of another user, leading to potential account takeover.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9418?
CVE-2024-9418 is considered a critical severity vulnerability due to the exposure of user passwords in plaintext.
How do I fix CVE-2024-9418?
To fix CVE-2024-9418, update the transformeroptimus/superagi software to a version that does not expose user passwords in plaintext.
Which versions of transformeroptimus/superagi are affected by CVE-2024-9418?
CVE-2024-9418 affects version 0.0.14 of transformeroptimus/superagi.
What impact does CVE-2024-9418 have on user accounts?
CVE-2024-9418 allows attackers to retrieve other users' passwords, potentially leading to account takeover.
Is there a workaround for CVE-2024-9418 until a fix is available?
As of now, the best course of action is to avoid using the affected API endpoint `/api/users/get/{id}` until a patch is released.