composio allows Server-Side Request Forgery (SSRF) in BROWSERTOOL

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-8955 · ADVISORY
• ComposioHQ/composio · PACKAGE
• ComposioHQ/composio · WEB
• huntr.com/bounties/13bc0399-2d9b-449e-95f2-6e9a7e39383d · WEB
• pypi.org/project/composio-core · PACKAGE
• GitHub Advisory GHSA-38mg-wm59-g64x · ADVISORY

Mais vulnerabilidades de composio-core

• CVE-2024-8953CRÍTICO 9.8In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operation…
• CVE-2024-8952ALTO 7.5A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WE…
• CVE-2024-8865MÉDIO 4.9A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic. Affected by this issue is the function path of t…
• CVE-2024-8864ALTO 8.8A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function…