Lucene search

TenableVULNRICHMENT:CVE-2024-7790

HistoryAug 14, 2024 - 1:49 p.m.

CVE-2024-7790 DevikaAI Stored Cross-Site Scripting

2024-08-1413:49:42

tenable

github.com

devikaai

stored cross-site scripting

vulnerability

improperly decoded user input

cve-2024-7790

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

Percentile

14.7%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

A stored cross site scripting vulnerabilities exists in DevikaAI from commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2 onwards via improperly decoded user input.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "DevikaAI",
    "repo": "https://github.com/stitionai/devika",
    "vendor": "Devikia",
    "versions": [
      {
        "lessThanOrEqual": "current",
        "status": "affected",
        "version": "6acce21fb08c3d1123ef05df6a33912bf0ee77c2",
        "versionType": "custom"
      }
    ]
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:stitionai:devika:*:*:*:*:*:*:*:*"
    ],
    "vendor": "stitionai",
    "product": "devika",
    "versions": [
      {
        "status": "affected",
        "version": "6acce21fb08c3d1123ef05df6a33912bf0ee77c2",
        "versionType": "git",
        "lessThanOrEqual": "*"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

www.tenable.com/security/research/tra-2024-31

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

Percentile

14.7%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-7790