Vulnerability · Published May 6, 2024 · Assigned by @huntr_ai
CVE-2024-2913Race Condition Vulnerability in mintplex-labs/anything-llm
Medium 6.5
In plain English
A medium-severity security flaw in mintplex-labs/anything-llm from mintplex-labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Official description
A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user accounts from a single invite link intended for only one user. This bypasses the intended security mechanism that restricts invite acceptance to a single user, leading to unauthorized user creation without detection in the invite tab. The issue is due to the lack of validation for concurrent requests in the backend.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mintplex-labs | mintplex-labs/anything-llm | unspecified – through latest |
Weakness: CWE-367 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N