CVE-2024-12048
IDOR Vulnerability in transformeroptimus/superagi
Résumé
IDOR Vulnerability in transformeroptimus/superagi
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.
Références
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com