Publish GHSA-r438-q28f-28gp

advisories/unreviewed/2024/12/GHSA-r438-q28f-28gp/GHSA-r438-q28f-28gp.json

@@ -0,0 +1,41 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-r438-q28f-28gp",
+  "modified": "2024-12-16T03:33:59Z",
+  "published": "2024-12-16T03:33:59Z",
+  "aliases": [
+    "CVE-2024-56083"
+  ],
+  "details": "Cognition Devin before 2024-12-12 provides write access to code by an attacker who discovers the https://vscode-randomly_generated_string.devinapps.com URL (aka the VSCode live share URL) for a specific \"Use Devin's Machine\" session. For example, this URL may be discovered if a customer posts a screenshot of a Devin session to social media, or publicly streams their Devin session.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56083"
+    },
+    {
+      "type": "WEB",
+      "url": "https://news.ycombinator.com/item?id=42420423"
+    },
+    {
+      "type": "WEB",
+      "url": "https://trust.cognition.ai"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.youtube.com/watch?v=927W6zzvV-c"
+    },
+    {
+      "type": "WEB",
+      "url": "https://x.com/cognition_labs/status/1867351521035530698"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-16T03:15:04Z"
+  }
+}