PT-2024-36528 · Unknown · Stitionai/Devika

Arajgor · Published 2024-07-09 · Updated 2025-07-15 · CVE-2024-5549

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions stitionai/devika repository (affected versions not specified)

Description The issue is caused by a CORS misconfiguration, which allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. Attackers can also perform actions on behalf of the user, including deleting projects or sending messages, due to the lack of proper origin validation. This enables unauthorized cross-origin requests to be executed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2024-5549

Affected Products

Stitionai/Devika

References · 7

• 🔥 https://huntr.com/bounties/7ffeb896-27c8-429d-b241-4f7d6dda0afd · Exploit
• https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2 · Patch
• https://osv.dev/vulnerability/CVE-2024-5549 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5549 · Security Note
• https://t.me/cvenotify/128983 · Telegram Post
• https://t.me/cvenotify/85437 · Telegram Post
• https://t.me/cvedetector/221 · Telegram Post