Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-6842Exposure of Sensitive Information in mintplex-labs/anything-llm
High 7.5
In plain English
A high-severity missing authentication in mintplex-labs/anything-llm from mintplex-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 36.3% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mintplex-labs | mintplex-labs/anything-llm | unspecified – before 1.0.2 |
Weakness: CWE-306 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N