CVE-2024-8251

Katalog CVE

CVSS 5.3 · Medium EPSS 0,49%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada mintplexlabs anythingllm. Skor CVSS 3.0 5.3 (Medium) menurut huntr.dev.

Deskripsi (NVD)

A vulnerability in mintplex-labs/anything-llm prior to version 1.2.2 allows for Prisma injection. The issue exists in the API endpoint "/embed/:embedId/stream-chat" where user-provided JSON is directly taken to the Prisma library's where clause. An attacker can exploit this by providing a specially crafted JSON object, such as {"sessionId":{"not":"a"}}, causing Prisma to return all data from the table. This can lead to unauthorized access to all user queries in embedded chat mode.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.0

5.3 (Medium), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mintplex-labs/anything-llm/commit/334fd9cdd02ad4aa6a3c9bdfc95e7764651c13f4 patch
• https://huntr.com/bounties/7c263ef1-7d50-475a-9425-b15df4e0403c exploit · advisory pihak ketiga