CVE-2024-0404

Katalog CVE

CVSS 9.1 · Critical EPSS 0,78%

Kerentanan Improperly Controlled Modification of Dynamically-Determined Object Attributes pada mintplexlabs anythingllm. Skor CVSS 3.0 9.1 (Critical) menurut huntr.dev.

Deskripsi (NVD)

A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of high-privileged accounts. By intercepting and modifying the HTTP request during the account creation process via an invitation link, an attacker can add a `role` property with `admin` value, thereby gaining administrative access. This issue arises due to the lack of property allowlisting and blocklisting, enabling the attacker to exploit the system and perform actions as an administrator.

Rincian

Terbit di NVD

16 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.0

9.1 (Critical), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mintplex-labs/anything-llm/commit/8cd3a92c660b202655d99bee90b2864694c99946 patch
• https://huntr.com/bounties/b4355bae-766a-4bb0-942b-607bc491b23d exploit · advisory pihak ketiga