CVE-2024-9418

Name of the Vulnerable Software and Affected Versions transformeroptimus/superagi version 0.0.14

Description The API endpoint /api/users/get/{id} returns the user's password in plaintext, allowing an attacker to retrieve the password of another user. This could lead to potential account takeover.

Recommendations For version 0.0.14, consider disabling the /api/users/get/{id} endpoint until a patch is available to prevent the exposure of user passwords. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the id variable in the affected API endpoint until the issue is resolved.