PT-2024-39283 · Composiohq · Composio

Aftersnow

·

Published

2024-09-14

·

Updated

2024-09-17

·

CVE-2024-8865

CVSS v3.1

4.9

Medium

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions: composiohq composio versions up to 0.5.8
Description: A vulnerability was found in composiohq composio, classified as problematic. The issue affects the function path of the file composioserverapi.py. The manipulation of the file argument leads to path traversal. The vendor was contacted about this disclosure but did not respond. Elevated activities targeting this issue have been observed.
Recommendations: For versions up to 0.5.8, as a temporary workaround, consider restricting access to the vulnerable function path in the composioserverapi.py file until a patch is available. Avoid using the file argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-8865
GHSA-66R2-XM28-74W9

Affected Products

Composio