A JSON Injection vulnerability exists in the `mintplex-labs/anything-llm` application, specifically within the username parameter during the login process at the `/api/request-token` endpoint. The vulnerability arises from improper handling of values, allowing attackers to perform brute force attacks without prior knowledge of the username. Once the password is known, attackers can conduct blind attacks to ascertain the full username, significantly compromising system security.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/8af4650d-5955-44a4-86b4-d08e1c862b49 | Exploit Third Party Advisory |
| https://github.com/mintplex-labs/anything-llm/commit/2374939ffb551ab2929d7f9d5827fe6597fa8caa | Patch |
Configurations
History
22 Oct 2024, 14:26
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-307 | |
| CPE | cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| First Time |
Mintplexlabs
Mintplexlabs anythingllm |
|
| References | () https://huntr.com/bounties/8af4650d-5955-44a4-86b4-d08e1c862b49 - Exploit, Third Party Advisory | |
| References | () https://github.com/mintplex-labs/anything-llm/commit/2374939ffb551ab2929d7f9d5827fe6597fa8caa - Patch |
06 Jun 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-06 19:15
Updated : 2024-11-03 17:15
NVD link : CVE-2024-3102
Mitre link : CVE-2024-3102
JSON object : View
Products Affected
mintplexlabs
- anythingllm
CWE
CWE-307
Improper Restriction of Excessive Authentication Attempts