CVE-2024-12048: falha de alta gravidade em transformeroptimus/superagi
IDOR Vulnerability in transformeroptimus/superagi
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.7%
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
transformeroptimus · transformeroptimus/superagiCVEs relacionadas — transformeroptimus/superagi
No mesmo produto, das mais perigosas para as menos.
CVE-2024-9415HIGHPath Traversal in transformeroptimus/superagiEPSS 1.5%CVE-2024-9439HIGHRemote Code Execution in transformeroptimus/superagiEPSS 1.2%CVE-2024-9437HIGHUnauthenticated Denial of Service in transformeroptimus/superagiEPSS 0.8%CVE-2024-9431MEDIUMImproper Privilege Management in transformeroptimus/superagiEPSS 0.6%CVE-2024-10267HIGHInformation Disclosure in transformeroptimus/superagiEPSS 0.6%CVE-2024-9447MEDIUMExposure of Sensitive Information in transformeroptimus/superagiEPSS 0.6%