Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access to the system prior to the attack.
It is worth noting that the deterministic nature of the export name is lower risk as the UI for exporting would start the download at the same time, which once downloaded - deletes the export from the system.
The endpoint for exporting should simply be patched to a higher privilege level.
References
Configurations
History
04 Mar 2025, 12:24
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/mintplex-labs/anything-llm/commit/7aaa4b38e7112a6cd879c1238310c56b1844c6d8 - Patch | |
| References | () https://huntr.com/bounties/f114c787-ab5f-4f83-afa5-c000435efb78 - Exploit | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
| CWE | ||
| First Time |
Mintplexlabs anythingllm
Mintplexlabs |
|
| CPE | cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:* |
27 Feb 2024, 14:19
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-27 14:15
Updated : 2025-03-04 12:24
NVD link : CVE-2024-0551
Mitre link : CVE-2024-0551
JSON object : View
Products Affected
mintplexlabs
- anythingllm
CWE
No CWE.