CVE-2024-0795

Katalog CVE

CVSS 7.2 · High EPSS 0,95%

Kerentanan Improper Access Control pada mintplexlabs anythingllm. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an `admin` role and then be able to use this new account to have elevated privileges on the instance

Rincian

Terbit di NVD

2 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mintplex-labs/anything-llm/commit/9a237db3d1f66cdbcf5079599258f5fb251c5564 patch
• https://huntr.com/bounties/f69e3307-7b44-4776-ac60-2990990723ec exploit · advisory pihak ketiga