From b3fec174de8097b27c8b36f9f7b02142fc3b3ba4 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 16 Dec 2024 03:35:43 +0000
Subject: [PATCH] Publish GHSA-r438-q28f-28gp

---
 .../GHSA-r438-q28f-28gp.json                  | 41 +++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 advisories/unreviewed/2024/12/GHSA-r438-q28f-28gp/GHSA-r438-q28f-28gp.json

diff --git a/advisories/unreviewed/2024/12/GHSA-r438-q28f-28gp/GHSA-r438-q28f-28gp.json b/advisories/unreviewed/2024/12/GHSA-r438-q28f-28gp/GHSA-r438-q28f-28gp.json
new file mode 100644
index 00000000000..fcf76759f3b
--- /dev/null
+++ b/advisories/unreviewed/2024/12/GHSA-r438-q28f-28gp/GHSA-r438-q28f-28gp.json
@@ -0,0 +1,41 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-r438-q28f-28gp",
+  "modified": "2024-12-16T03:33:59Z",
+  "published": "2024-12-16T03:33:59Z",
+  "aliases": [
+    "CVE-2024-56083"
+  ],
+  "details": "Cognition Devin before 2024-12-12 provides write access to code by an attacker who discovers the https://vscode-randomly_generated_string.devinapps.com URL (aka the VSCode live share URL) for a specific \"Use Devin's Machine\" session. For example, this URL may be discovered if a customer posts a screenshot of a Devin session to social media, or publicly streams their Devin session.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56083"
+    },
+    {
+      "type": "WEB",
+      "url": "https://news.ycombinator.com/item?id=42420423"
+    },
+    {
+      "type": "WEB",
+      "url": "https://trust.cognition.ai"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.youtube.com/watch?v=927W6zzvV-c"
+    },
+    {
+      "type": "WEB",
+      "url": "https://x.com/cognition_labs/status/1867351521035530698"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-16T03:15:04Z"
+  }
+}
\ No newline at end of file