PT-2024-37182 · Devika · Devika

Published 2024-06-27 · Updated 2025-07-15 · CVE-2024-5820

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: stitutionai/devika version ecee79f

Description: The issue arises from an unprotected WebSocket connection, allowing a malicious website to connect to the backend and issue commands on behalf of the user. This enables the malicious website to intercept all communication between the user and the backend, potentially leading to unauthorized command execution and server-side request forgery.

Recommendations: For version ecee79f, consider restricting access to the WebSocket connection to prevent malicious websites from intercepting communication and issuing unauthorized commands. As a temporary workaround, disabling the WebSocket connection until a proper fix is implemented can help minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-5820

Affected Products

Devika

References · 5

• 🔥 https://huntr.com/bounties/2ba757bf-8ede-445b-b143-2de7769758a6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-5820 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5820 · Vendor Advisory
• https://t.me/cvenotify/85984 · Telegram Post
• https://t.me/cvenotify/129043 · Telegram Post