PT-2025-12281 · Unknown · Transformeroptimus/Superagi

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-9418

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions transformeroptimus/superagi version 0.0.14

Description The API endpoint /api/users/get/{id} returns the user's password in plaintext, allowing an attacker to retrieve the password of another user. This could lead to potential account takeover.

Recommendations For version 0.0.14, consider disabling the /api/users/get/{id} endpoint until a patch is available to prevent the exposure of user passwords. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the id variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

CVE-2024-9418

Affected Products

Transformeroptimus/Superagi

References · 4

• 🔥 https://huntr.com/bounties/9a8118a2-ea32-41f5-b501-fef4f31d8213 · Exploit
• https://osv.dev/vulnerability/CVE-2024-9418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9418 · Security Note
• https://twitter.com/CVEnew/status/1902968911173423457 · Twitter Post