PT-2024-24905 · Mintplex · Anything-Llm

Published 2024-04-10 · Updated 2025-07-09 · CVE-2024-3283

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm (affected versions not specified)

Description A mass assignment issue allows users with manager roles to escalate their privileges to admin roles. The '/admin/system-preferences' API endpoint improperly authorizes manager-level users to modify the multi user mode system variable, enabling them to access the '/api/system/enable-multi-user' endpoint and create a new admin user. This issue results from the endpoint accepting a full JSON object in the request body without proper validation of modifiable fields, leading to unauthorized modification of system settings and subsequent privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2024-3283

Affected Products

Anything-Llm

References · 6

• 🔥 https://huntr.com/bounties/a8000cce-0ecb-4820-9cfb-57ba6f4d58a2 · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-3283 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3283 · Vendor Advisory
• https://t.me/cvenotify/128268 · Telegram Post
• https://twitter.com/CVEnew/status/1778118894005137679 · Twitter Post