CVE-2024-40422
68Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.1epss 11%
from disclosure to weapon11 days
Published on NVDJul 24
1st PoC+11d
exploitation probability
11%top 4% of all CVEs
observed exploitation
nono source reports it
3 public exploit(s)
The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
n/a · n/apublic PoCs found — 3
exploitdbwww.exploit-db.com/exploits/52066unverifiedgithubgithub.com/j3r1ch0123/CVE-2024-40422★ 1githubgithub.com/alpernae/CVE-2024-40422★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.