PT-2024-38582 · Devikaai · Devikaai

Joshua Martinelle · Published 2024-08-14 · Updated 2024-08-20 · CVE-2024-7790

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DevikaAI versions from commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2 onwards

Description A stored cross site scripting issue exists due to improperly decoded user input. This allows for the storage and subsequent execution of malicious scripts, potentially leading to unauthorized actions on behalf of the user.

Recommendations For versions from commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2 onwards, consider implementing proper input decoding and validation to prevent the storage of malicious scripts. As a temporary workaround, restrict user input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-7790

Affected Products

Devikaai

References · 6

• 🔥 https://tenable.com/security/research/tra-2024-31 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-7790 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7790 · Vendor Advisory
• https://t.me/cvenotify/91396 · Telegram Post
• https://t.me/cvedetector/3133 · Telegram Post
• https://twitter.com/CVEnew/status/1823724922121654762 · Twitter Post