CVE-2024-5549 Data leak through CORS misconfiguration in stitionai/devika

A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability also enables attackers to perform actions on behalf of the user, such as...

CVE-2024-5549

CVE-2024-5549 involves a CORS misconfiguration in the stitionai/devika repository. The root cause is improper origin validation, permitting unauthorized cross-origin requests. Impact stated includes data leakage (logs, browser sessions, private API keys) and the ability to perform actions on beha...