CVE-2024-9418: medium-severity vulnerability in transformeroptimus/superagi
Insufficiently Protected Credentials in transformeroptimus/superagi
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.6%
In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in plaintext. This vulnerability allows an attacker to retrieve the password of another user, leading to potential account takeover.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
transformeroptimus · transformeroptimus/superagiRelated CVEs — transformeroptimus/superagi
In the same product, most dangerous first.
CVE-2024-9415HIGHPath Traversal in transformeroptimus/superagiEPSS 1.5%CVE-2024-9439HIGHRemote Code Execution in transformeroptimus/superagiEPSS 1.2%CVE-2024-9437HIGHUnauthenticated Denial of Service in transformeroptimus/superagiEPSS 0.8%CVE-2024-12048HIGHIDOR Vulnerability in transformeroptimus/superagiEPSS 0.7%CVE-2024-9431MEDIUMImproper Privilege Management in transformeroptimus/superagiEPSS 0.6%CVE-2024-10267HIGHInformation Disclosure in transformeroptimus/superagiEPSS 0.6%