PT-2024-15564 · Git+2 · Anything-Llm+1

Published 2024-02-25 · Updated 2024-02-26 · CVE-2024-0440

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description The issue allows an attacker, with permission to submit a link or submitting a link via POST to be collected that is using the file:// protocol, to introspect host files and other relatively stored files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-0440

Affected Products

Anything-Llm

Mintplex-Labs/Anything-Llm

References · 6

• 🔥 https://huntr.com/bounties/263fd7eb-f9a9-4578-9655-0e28c609272f · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/1563a1b20f72846d617a88510970d0426ab880d3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-0440 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0440 · Vendor Advisory
• https://twitter.com/CVEnew/status/1761831766782833018 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1762187759857406304 · Twitter Post