CVE-2024-6331 is a Local File Read (LFI) vulnerability affecting the stitionai/devika main branch (commit cdfb782b0e634b773b10963c8034dc9207ba1f9f) due to Prompt Injection. The integration of Google Gemini 1.0 Pro with disabled content protection for hate speech and harassment allows malicious commands to be executed. This enables an attacker to read sensitive files, such as /etc/passwd. The vulnerability has a CVSS score of 6.5 (MEDIUM), indicating it can be exploited remotely with low privileges and no user interaction, leading to high confidentiality impact. The attack complexity is low, making it relatively easy to exploit. Currently, there is no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB. The CVE has received minimal community discussion and media coverage, suggesting it is not widely known or actively targeted at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2024-05-02CPE matchmatch criteria | cpe:2.3:a:stitionai:devika:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.