CVE-2024-3029

Katalog CVE

CVSS 8.0 · High EPSS 0,73%

Kerentanan Improper Input Validation pada mintplexlabs anythingllm. Skor CVSS 3.1 8.0 (High) menurut NVD.

Deskripsi (NVD)

In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint. This triggers an error that is caught by a catch block, which in turn deletes all users and disables the 'multi_user_mode'. The vulnerability allows an attacker to remove all existing users and potentially create a new admin user without requiring a password, leading to unauthorized access and control over the application.

Rincian

Terbit di NVD

16 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.0 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 53,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mintplex-labs/anything-llm/commit/99cfee1e7025fe9a0919a4d506ba1e1b819f6073 patch
• https://huntr.com/bounties/7189a7a0-9830-459d-b853-bdc2559999a0 exploit · advisory pihak ketiga