PT-2025-12223 · Unknown · Anything-Llm

Published 2025-03-20 · Updated 2025-07-15 · CVE-2024-8196

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm version 1.5.11

Description The application opens server port 3001 on 0.0.0.0 with no authentication by default, allowing an attacker to gain full backend access. This enables them to perform actions such as deleting all data from the workspace.

Recommendations For version 1.5.11, consider disabling access to server port 3001 until a patch is available, or implement authentication mechanisms to restrict unauthorized access. As a temporary workaround, restrict access to the backend to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-8196

Affected Products

Anything-Llm

References · 7

• 🔥 https://huntr.com/bounties/dbde1c71-7aa5-46f6-847a-d89793cf97a9 · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/9bfe477f10b188bfe3508ac29105df80d4522ece · Patch
• https://osv.dev/vulnerability/CVE-2024-8196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8196 · Security Note
• https://t.me/cvenotify/129032 · Telegram Post
• https://twitter.com/CveFindCom/status/1902670885678682523 · Twitter Post
• https://twitter.com/CVEnew/status/1902670968780198077 · Twitter Post