CVE-2024-10457: fallo de gravedad media en significant-gravitas/autogpt
SSRF Vulnerabilities in significant-gravitas/autogpt
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.6%
Multiple Server-Side Request Forgery (SSRF) vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in the GitHub Integration and Web Search blocks. These vulnerabilities affect version agpt-platform-beta-v0.1.1. The issues arise when block inputs are controlled by untrusted sources, leading to potential credential leakage, internal network scanning, and unauthorized access to internal services, APIs, or data stores. The affected blocks include GithubListPullRequestsBlock, GithubReadPullRequestBlock, GithubAssignPRReviewerBlock, GithubListPRReviewersBlock, GithubUnassignPRReviewerBlock, GithubCommentBlock, GithubMakeIssueBlock, GithubReadIssueBlock, GithubListIssuesBlock, GithubAddLabelBlock, GithubRemoveLabelBlock, GithubListBranchesBlock, and ExtractWebsiteContentBlock.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Productos afectados
significant-gravitas · significant-gravitas/autogptCVEs relacionadas — significant-gravitas/autogpt
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-1040HIGHServer-Side Template Injection (SSTI) in significant-gravitas/autogptEPSS 1.7%CVE-2024-8156HIGHCommand Injection in significant-gravitas/autogptEPSS 1.7%CVE-2024-1881HIGHImproper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogptEPSS 1.4%CVE-2024-1880HIGHOS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogptEPSS 1.0%CVE-2024-6091CRITICALShell Command Denylist Bypass in significant-gravitas/autogptEPSS 0.8%CVE-2025-0454HIGHSSRF Check Bypass in Requests Utility in significant-gravitas/autogptEPSS 0.6%