CVE-2024-6842

Katalog CVE

CVSS 7.5 · High EPSS 31,1%

Kerentanan Missing Authentication for Critical Function pada mintplexlabs anythingllm. Skor CVSS 3.0 7.5 (High) menurut huntr.dev.

Deskripsi (NVD)

In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.0

7.5 (High), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

31,1% peluang dieksploitasi; lebih tinggi dari 98,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mintplex-labs/anything-llm/commit/8b1ceb30c159cf3a10efa16275bc6849d84e4ea8 patch
• https://huntr.com/bounties/cd911fc7-ac6b-4974-acd0-9cc926fa8d9e exploit · advisory pihak ketiga