CVE-2024-3150

Katalog CVE

CVSS 8.8 · High EPSS 0,79%

Kerentanan Improper Handling of Exceptional Conditions pada mintplexlabs anythingllm. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges to Administrator. The issue arises from improper input validation when handling HTTP POST requests to the endpoint `/workspace/:slug/thread/:threadSlug/update`. Specifically, the application fails to validate or check user input before passing it to the `workspace_thread` Prisma model for execution. This oversight allows attackers to craft a Prisma relation query operation that manipulates the `users` model to change a user's role to admin. Successful exploitation grants attackers the highest level of user privileges, enabling them to see and perform all actions within the system.

Rincian

Terbit di NVD

6 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-755: Improper Handling of Exceptional Conditions

EPSS (30 hari)

0,79% peluang dieksploitasi; lebih tinggi dari 55,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mintplex-labs/anything-llm/commit/200bd7f0615347ed2efc07903d510e5a208b0afc patch
• https://huntr.com/bounties/745f5c80-14ea-4055-9f15-a066ae93e5a3 exploit · advisory pihak ketiga