CVE-2024-6842highCWE-306

CVE-2024-6842: high-severity vulnerability in mintplex-labs/anything-llm

Exposure of Sensitive Information in mintplex-labs/anything-llm

Published · Updated

Follow this CVE+ Monitor mintplex-labs/anything-llm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.5epss 36%
In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
mintplex-labs · mintplex-labs/anything-llm
Related CVEs — mintplex-labs/anything-llm

In the same product, most dangerous first.

CVE-2024-13059HIGHPath Traversal in mintplex-labs/anything-llmEPSS 24.3%CVE-2024-5211CRITICALPath Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3025CRITICALPath Traversal in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3104CRITICALRemote Code Execution in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3166LOWCross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3283HIGHPrivilege Escalation via Mass Assignment in mintplex-labs/anything-llmEPSS 0.9%