PT-2024-35128 · Unknown · Anything-Llm

Published 2024-06-25 · Updated 2025-07-15 · CVE-2024-5216

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions anything-llm (affected versions not specified)

Description A Denial of Service (DoS) condition can occur due to uncontrolled resource consumption. The issue arises from the application's failure to limit the size of username fields, enabling attackers to create users with excessively bulky texts, resulting in the user management panel becoming unresponsive. This prevents administrators from performing critical user management actions and allows malicious users to perpetuate their presence within the system indefinitely, undermining the system's security posture and degrading overall system performance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-5216

Affected Products

Anything-Llm

References · 6

• 🔥 https://huntr.com/bounties/8ec14991-ee35-493d-a8d3-21a1cfd57869 · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/3ef009de73c837f9025df8bba62572885c70c72f · Patch
• https://osv.dev/vulnerability/CVE-2024-5216 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5216 · Security Note
• https://t.me/cvenotify/84328 · Telegram Post
• https://t.me/cvenotify/129038 · Telegram Post