In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/mintplex-labs/anything-llm/commit/8b1ceb30c159cf3a10efa16275bc6849d84e4ea8 | Patch |
| https://huntr.com/bounties/cd911fc7-ac6b-4974-acd0-9cc926fa8d9e | Exploit Third Party Advisory |
Configurations
History
15 Jul 2025, 15:11
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mintplexlabs anythingllm
Mintplexlabs |
|
| CPE | cpe:2.3:a:mintplexlabs:anythingllm:1.5.5:*:*:*:*:*:*:* | |
| References | () https://github.com/mintplex-labs/anything-llm/commit/8b1ceb30c159cf3a10efa16275bc6849d84e4ea8 - Patch | |
| References | () https://huntr.com/bounties/cd911fc7-ac6b-4974-acd0-9cc926fa8d9e - Exploit, Third Party Advisory |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-15 15:11
NVD link : CVE-2024-6842
Mitre link : CVE-2024-6842
JSON object : View
Products Affected
mintplexlabs
- anythingllm
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor