CVE-2024-9447

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-9447

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9447.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-9447

Published

2025-03-20T10:10:10.551Z

Modified

2026-07-15T01:49:15.984813247Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Exposure of Sensitive Information in transformeroptimus/superagi

Details

An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. The /get/organisation/ endpoint does not verify the user's organization, allowing any authenticated user to retrieve sensitive configuration details, including API keys, of any organization. This could lead to unauthorized access to services and significant data breaches or financial loss.

Database specific

{
    "cwe_ids": [
        "CWE-1230"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9447.json",
    "cna_assigner": "@huntr_ai"
}

References

Affected packages

Git / github.com/transformeroptimus/superagi

Affected ranges

Type

GIT

Repo

https://github.com/transformeroptimus/superagi

Events

Introduced

7411a016d458619e26fed43718421f9fac9d10e0

Last affected

7411a016d458619e26fed43718421f9fac9d10e0

Database specific

{
    "cpe": "cpe:2.3:a:superagi:superagi:0.0.14:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.0.14"
        },
        {
            "last_affected": "0.0.14"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

0.*

0.0.14

v0.*

v0.0.14

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9447.json"