PT-2024-15559 · Git+2 · Anything-Llm+1

Published 2024-02-25 · Updated 2025-02-25 · CVE-2024-0435

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue allows a user to send a chat containing an XSS opportunity, which will execute when the chat is sent and on subsequent page loads. The risk is considered low because the minimum requirement for a user to send a chat is to be given access to a workspace via an admin. Additionally, the location where the XSS renders is limited to the user who submits it, effectively limiting the attack to the user attacking themselves. There is no anonymous chat submission unless the user fails to take the minimum steps required to protect their instance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-0435

Affected Products

Anything-Llm

Mintplex-Labs/Anything-Llm

References · 6

• https://github.com/mintplex-labs/anything-llm/commit/a4ace56a401ffc8ce0082d7444159dfd5dc28834 · Patch
• https://osv.dev/vulnerability/CVE-2024-0435 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0435 · Security Note
• https://huntr.com/bounties/53308220-8b2e-492f-b248-0985b7c2db61 · Note
• https://t.me/cvenotify/112508 · Telegram Post
• https://twitter.com/CVEnew/status/1761801562689581288 · Twitter Post