A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1.
References
Configurations
History
01 Apr 2025, 20:34
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:mintplexlabs:anythingllm_docker:*:*:*:*:*:*:*:* | |
| References | () https://huntr.com/bounties/98a49c90-e095-441f-900c-59d463dc8e8f - Exploit | |
| References | () https://github.com/mintplex-labs/anything-llm/commit/696af19c45473172ad4d3ca749281800a4d1a45a - Patch | |
| First Time |
Mintplexlabs anythingllm Docker
Mintplexlabs |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
20 Mar 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-04-01 20:34
NVD link : CVE-2024-13060
Mitre link : CVE-2024-13060
JSON object : View
Products Affected
mintplexlabs
- anythingllm_docker
CWE
No CWE.