CVE-2024-9447: Exposure of Sensitive Information in transformeroptimus/superagi

Published Mar 20, 2025

Updated

An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. The /get/organisation/ endpoint does not verify the user's organization, allowing any authenticated user to retrieve sensitive configuration details, including API keys, of any organization. This could lead to unauthorized access to services and significant data breaches or financial loss.

Affected Software

2 affected components

transformeroptimus superagi

superagi SuperAGI=0.0.14

Event History

Mar 20, 2025

CVE Published

via MITRE·10:10 AM

Data Sourced

via MITRE·10:10 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-9447?

CVE-2024-9447 has been classified as a high severity information disclosure vulnerability.

How do I fix CVE-2024-9447?

To fix CVE-2024-9447, ensure that the `/get/organisation/` endpoint properly verifies the user's organization before returning sensitive data.

What software is affected by CVE-2024-9447?

CVE-2024-9447 affects the TransformerOptimus SuperAGI software.

What type of information is disclosed in CVE-2024-9447?

CVE-2024-9447 allows attackers to access sensitive configuration details, including API keys, from any organization.

Who is at risk from CVE-2024-9447?

Any authenticated user can exploit CVE-2024-9447 and potentially access sensitive data from other organizations.