CVE-2024-6433CWE-23

Local File Inclusion in stitionai/devika

High · published July 10, 2024

CVSS v3.0
7.5
EPSS
1%
Percentile
45.6
In the wild
Unconfirmed
What it is

The application zips all the files in the folder specified by the user, which allows an attacker to read arbitrary files on the system by providing a crafted path. This vulnerability can be exploited by sending a request to the application with a malicious snapshot_path parameter.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00556 · 45.6th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2024-07-10T00:00Z
EPSS history
Timeline
  • 10 JUL 00:00Z
    Local File Inclusion in stitionai/devika
    cvelistv5