CVE-2024-5208

Katalog CVE

CVSS 6.5 · Medium EPSS 0,62%

Kerentanan Allocation of Resources Without Limits or Throttling pada mintplexlabs anythingllm. Skor CVSS 3.0 6.5 (Medium) menurut huntr.dev.

Deskripsi (NVD)

An uncontrolled resource consumption vulnerability exists in the `upload-link` endpoint of mintplex-labs/anything-llm. This vulnerability allows attackers to cause a denial of service (DOS) by shutting down the server through sending invalid upload requests. Specifically, the server can be made to shut down by sending an empty body with a 'Content-Length: 0' header or by sending a body with arbitrary content, such as 'asdasdasd', with a 'Content-Length: 9' header. The vulnerability is reproducible by users with at least a 'Manager' role, sending a crafted request to any workspace. This issue indicates that a previous fix was not effective in mitigating the vulnerability.

Rincian

Terbit di NVD

19 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.0

6.5 (Medium), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mintplex-labs/anything-llm/commit/e2439c6d4c3cfdacd96cd1b7b92d1f89c3cc8459 patch
• https://huntr.com/bounties/6c8bdfa1-ec56-4b02-bde9-cfc27470e6ca exploit · advisory pihak ketiga