PT-2024-24131 · Mintplex · Anything-Llm

Published 2024-06-06 · Updated 2024-09-20 · CVE-2024-3153

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm (affected versions not specified)

Description The issue is related to an uncontrolled resource consumption vulnerability in the upload file endpoint, which can lead to a denial of service (DOS) condition. Specifically, the server can be shut down by sending an invalid upload request. An attacker with the ability to upload documents can exploit this vulnerability to cause a DOS condition by manipulating the upload request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-3153

Affected Products

Anything-Llm

References · 7

• 🔥 https://huntr.com/bounties/7bb08e7b-fd99-411e-99bc-07f81f474635 · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/b8d37d9f43af2facab4c51146a46229a58cb53d9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-3153 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3153 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1798817229355856203 · Twitter Post
• https://t.me/cvenotify/95417 · Telegram Post
• https://twitter.com/CVEnew/status/1798789761928429875 · Twitter Post