PT-2024-15651 · Git+2 · Anything-Llm+1

Published 2024-02-27 · Updated 2024-02-27 · CVE-2024-0551

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description The issue allows exports of the database and associated exported information of the system via the default user role. An attacker would need to have been granted access to the system prior to the attack. The endpoint for exporting is at a lower privilege level than expected. The export process starts a download and then deletes the export from the system, which reduces the risk due to the deterministic nature of the export name.

Recommendations To resolve the issue, the endpoint for exporting should be patched to a higher privilege level. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-0551

Affected Products

Anything-Llm

Mintplex-Labs/Anything-Llm

References · 6

• 🔥 https://huntr.com/bounties/f114c787-ab5f-4f83-afa5-c000435efb78 · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/7aaa4b38e7112a6cd879c1238310c56b1844c6d8 · Patch
• https://osv.dev/vulnerability/CVE-2024-0551 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0551 · Security Note
• https://twitter.com/CVEnew/status/1762481159919821102 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1762502410382024985 · Twitter Post