Anythingllm
CVE-2024-0440
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and other relatively stored files.
AnalysisAI
Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and other relatively stored files. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Technical ContextAI
This vulnerability is classified as Server-Side Request Forgery (SSRF) (CWE-918), which allows attackers to make the server perform requests to unintended internal or external resources. Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and other relatively stored files. Affected products include: Mintplexlabs Anythingllm.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Validate and allowlist destination URLs, block requests to internal networks, use network segmentation.
More in Anythingllm
View allAnythingLLM version 1.5.5 exposes sensitive system settings including search engine API keys through the unauthenticated
mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input
A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment varia
Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated critical severity (CVSS 9.
An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/
An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the i
A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository,
Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0. Rated critical severity (CVSS
In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Man
A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. Rate
mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoin
As a manager, you should not be able to modify a series of settings. Rated high severity (CVSS 8.8), this vulnerability
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today