CVE-2024-5752
Last modified
CVE-2024-5752 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. A path traversal vulnerability exists in stitionai/devika, specifically in the project creation functionality. In the affected version beacf6edaa205a5a5370525407a6db45137873b3, the project name is not validated, allowing an attacker to create a project with a crafted name that traverses directories. EPSS estimates a 1.44% chance of exploitation in the next 30 days.
Description
A path traversal vulnerability exists in stitionai/devika, specifically in the project creation functionality. In the affected version beacf6edaa205a5a5370525407a6db45137873b3, the project name is not validated, allowing an attacker to create a project with a crafted name that traverses directories. This can lead to arbitrary file overwrite when the application generates code and saves it to the specified project directory, potentially resulting in remote code execution.
Metrics
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-5752?
How severe is CVE-2024-5752?
How do I fix CVE-2024-5752?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-57509Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602…7.8
- CVE-2024-5751BerriAI/litellm version v1.35.8 contains a vulnerability whe…9.8
- CVE-2024-57510Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602…7.8
- CVE-2024-57513A floating-point exception (FPE) vulnerability exists in the…6.5
- CVE-2024-57514The TP-Link Archer A20 v3 router is vulnerable to Cross-site…4.8
- CVE-2024-57519An issue in Open5GS v.2.7.2 allows a remote attacker to caus…7.5
- CVE-2024-57520Insecure Permissions vulnerability in asterisk v22 allows a …9.8
- CVE-2024-57521SQL Injection vulnerability in RuoYi v.4.7.9 and before allo…10
- CVE-2024-57522SourceCodester Packers and Movers Management System v1.0 is …6.4
- CVE-2024-57523Cross Site Request Forgery (CSRF) in Users.php in SourceCode…4.5
- CVE-2024-57529Cross Site Scripting vulnerability in Jeppesen JetPlanner Pr…6.1
- CVE-2024-5753vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection…7.5
Are you affected by CVE-2024-5752?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST