PT-2025-12285 · Unknown · Transformeroptimus/Superagi

Published 2025-03-20 · Updated 2025-07-29 · CVE-2024-9447

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions transformeroptimus/superagi (affected versions not specified)

Description An information disclosure issue exists due to the lack of verification of a user's organization in the /get/organisation/ endpoint, allowing any authenticated user to retrieve sensitive configuration details, including API keys, of any organization. This could lead to unauthorized access to services and significant data breaches or financial loss.

Recommendations As a temporary workaround, consider restricting access to the /get/organisation/ endpoint until a patch is available. Avoid using the /get/organisation/ endpoint with authenticated users who do not need access to organization configuration details. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-1230

Related Identifiers

CVE-2024-9447

Affected Products

Transformeroptimus/Superagi

References · 5

• 🔥 https://huntr.com/bounties/c952ea32-3047-42d3-8a3e-e67899e35dfd · Exploit
• https://osv.dev/vulnerability/CVE-2024-9447 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9447 · Security Note
• https://t.me/cveNotify/130154 · Telegram Post
• https://twitter.com/CVEnew/status/1902674354422661553 · Twitter Post