Vulnerability · Published Mar 2, 2024 · Assigned by @huntr_ai
CVE-2024-0795Create user API role not enforced
High 7.2
In plain English
A high-severity improper access control in mintplex-labs/anything-llm from mintplex-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS 3.0)7.2High
Exploit odds (30 days)0.9%top 38.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an `admin` role and then be able to use this new account to have elevated privileges on the instance
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mintplex-labs | mintplex-labs/anything-llm | unspecified – before 1.0.0 |
Weakness: CWE-284 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H