CVE-2024-6842highCWE-306

CVE-2024-6842: falha de alta gravidade em mintplex-labs/anything-llm

Exposure of Sensitive Information in mintplex-labs/anything-llm

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar mintplex-labs/anything-llm

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

48Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 7.5epss 36%
In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
mintplex-labs · mintplex-labs/anything-llm
CVEs relacionadas — mintplex-labs/anything-llm

No mesmo produto, das mais perigosas para as menos.

CVE-2024-13059HIGHPath Traversal in mintplex-labs/anything-llmEPSS 24.3%CVE-2024-5211CRITICALPath Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3025CRITICALPath Traversal in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3104CRITICALRemote Code Execution in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3166LOWCross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3283HIGHPrivilege Escalation via Mass Assignment in mintplex-labs/anything-llmEPSS 0.9%