PT-2025-12169 · Unknown · Anything-Llm

Published 2025-03-20 · Updated 2025-07-15 · CVE-2024-6842

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm version 1.5.5

Description The issue allows unauthorized users to access sensitive system settings through the "/setup-complete" API endpoint. The data returned by the currentSettings function includes sensitive information, such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.

Recommendations For version 1.5.5, consider disabling access to the "/setup-complete" API endpoint until a patch is available to prevent unauthorized access to sensitive system settings. Restrict the use of the currentSettings function to authorized users only to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Information Disclosure

Weakness Enumeration

CWE-306

CWE-200

Related Identifiers

CVE-2024-6842

Affected Products

Anything-Llm

References · 6

• 🔥 https://huntr.com/bounties/cd911fc7-ac6b-4974-acd0-9cc926fa8d9e · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/8b1ceb30c159cf3a10efa16275bc6849d84e4ea8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-6842 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6842 · Vendor Advisory
• https://twitter.com/CVEnew/status/1902671116851929235 · Twitter Post
• https://t.me/cvenotify/129029 · Telegram Post