CVE-2024-8248: fallo de gravedad alta en mintplex-labs/anything-llm
Path Traversal in mintplex-labs/anything-llm
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.2epss 0.9%
A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The issue is fixed in version 1.2.2.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
mintplex-labs · mintplex-labs/anything-llmCVEs relacionadas — mintplex-labs/anything-llm
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-6842HIGHExposure of Sensitive Information in mintplex-labs/anything-llmEPSS 36.3%CVE-2024-13059HIGHPath Traversal in mintplex-labs/anything-llmEPSS 24.3%CVE-2024-5211CRITICALPath Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3025CRITICALPath Traversal in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3104CRITICALRemote Code Execution in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3166LOWCross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llmEPSS 1.0%