PT-2024-22751 · Unknown · Anything-Llm

Published 2024-05-06 · Updated 2025-07-09 · CVE-2024-2913

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions anything-llm (affected versions not specified)

Description A race condition vulnerability exists in the user invite acceptance process, allowing attackers to create multiple user accounts from a single invite link by sending multiple concurrent requests. This bypasses the security mechanism that restricts invite acceptance to a single user, leading to unauthorized user creation without detection. The issue is due to the lack of validation for concurrent requests in the backend.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2024-2913

Affected Products

Anything-Llm

References · 6

• 🔥 https://huntr.com/bounties/a3c69faf-cca0-4c10-8739-57e5bef7a95f · Exploit
• https://osv.dev/vulnerability/CVE-2024-2913 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2913 · Security Note
• https://twitter.com/CVEnew/status/1787888431311290552 · Twitter Post
• https://t.me/cvenotify/128275 · Telegram Post
• https://t.me/cvenotify/79326 · Telegram Post