VulnerabilityModified
CVE-2020-4039
SUSI.AI Server before version d27ed0f has a directory traversal vulnerability due to insufficient input validation.
CRITICAL 9.1EPSS 1.37%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SUSI.AI is an intelligent Open Source personal assistant. SUSI.AI Server before version d27ed0f has a directory traversal vulnerability due to insufficient input validation. Any admin config and file readable by the app can be retrieved by the attacker. Furthermore, some files can also be moved or deleted.
- CVSS 3.1
- 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 1.37% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-23, CWE-22
- Affected
- fossasia/susi.ai
- Source
- security-advisories@github.com
References
- https://github.com/fossasia/susi_server/security/advisories/GHSA-wcm4-2jp5-q269Patch, Third Party Advisory
- https://github.com/fossasia/susi_server/security/advisories/GHSA-wcm4-2jp5-q269Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.