Vulnerability · Published Apr 16, 2024 · Assigned by @huntr_ai

CVE-2024-3028Improper Input Validation in mintplex-labs/anything-llm

High 7.2

In plain English

A high-severity improper input validation in mintplex-labs/anything-llm from mintplex-labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.0)7.2High

Exploit odds (30 days)0.8%top 42.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logo_filename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the application's '.env' file, and even delete files by setting the 'logo_filename' to the path of the target file and invoking the 'remove-logo' API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input.

Affected products (as reported)

Vendor	Product	Versions
mintplex-labs	mintplex-labs/anything-llm	unspecified – before 1.0.0

Weakness: CWE-20 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References