CVE-2024-9447

{"id": "CVE-2024-9447", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-03-20T10:15:49.200", "references": [{"url": "https://huntr.com/bounties/c952ea32-3047-42d3-8a3e-e67899e35dfd", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-1230"}]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. The `/get/organisation/` endpoint does not verify the user's organization, allowing any authenticated user to retrieve sensitive configuration details, including API keys, of any organization. This could lead to unauthorized access to services and significant data breaches or financial loss."}, {"lang": "es", "value": "Existe una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en la \u00faltima versi\u00f3n de transformeroptimus/superagi. El endpoint `/get/organization/` no verifica la organizaci\u00f3n del usuario, lo que permite que cualquier usuario autenticado obtenga informaci\u00f3n confidencial de configuraci\u00f3n, incluidas las claves API, de cualquier organizaci\u00f3n. Esto podr\u00eda provocar acceso no autorizado a los servicios y graves filtraciones de datos o p\u00e9rdidas financieras."}], "lastModified": "2025-07-29T19:04:30.093", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:superagi:superagi:0.0.14:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C63CFCE-4FB2-47EC-A731-8C17458675D3"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}