CVE-2024-0440criticalCWE-918

CVE-2024-0440: critical vulnerability in mintplex-labs/anything-llm

SSRF - file:// unsanitized access to underlying host files

Published · Updated

Follow this CVE+ Monitor mintplex-labs/anything-llm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.6epss 0.6%
Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and other relatively stored files.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected products
mintplex-labs · mintplex-labs/anything-llm
Related CVEs — mintplex-labs/anything-llm

In the same product, most dangerous first.

CVE-2024-6842HIGHExposure of Sensitive Information in mintplex-labs/anything-llmEPSS 36.3%CVE-2024-13059HIGHPath Traversal in mintplex-labs/anything-llmEPSS 24.3%CVE-2024-5211CRITICALPath Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3025CRITICALPath Traversal in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3104CRITICALRemote Code Execution in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3166LOWCross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llmEPSS 1.0%