PT-2024-30180 · Mintplex · Anything-Llm

Published 2024-05-19 · Updated 2025-07-10 · CVE-2024-4284

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm versions prior to 1.0.0

Description A denial of service (DoS) condition can be triggered through the modification of a user's id attribute to a value of 0. This can render a chosen account completely inaccessible, leading to uncontrolled resource consumption. The issue is due to the lack of input validation and sanitization in the user modification endpoint and the middleware's token validation logic. An attacker with manager or admin privileges can exploit this issue.

Recommendations For versions prior to 1.0.0, update to version 1.0.0 to address the issue. As a temporary workaround, consider restricting access to the user modification endpoint to minimize the risk of exploitation. Additionally, avoid using the id attribute with a value of 0 in the affected endpoint until the issue is resolved.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-4284

Affected Products

Anything-Llm

References · 7

• 🔥 https://huntr.com/bounties/a5f45596-0aef-49e0-9f7d-63f1955a1552 · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/1b35bcbeab10b77e6dbd263cceecf1b965a40789 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-4284 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4284 · Vendor Advisory
• https://t.me/cvenotify/128372 · Telegram Post
• https://twitter.com/oktsec/status/1811251459792457812 · Twitter Post
• https://t.me/cvenotify/80404 · Telegram Post