Vulnerability · Published Jun 6, 2024 · Assigned by @huntr_ai

CVE-2024-3102JSON Injection in mintplex-labs/anything-llm

Medium 5.3

In plain English

A medium-severity security flaw in mintplex-labs/anything-llm from mintplex-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.0)5.3Medium

Exploit odds (30 days)0.5%top 60.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A JSON Injection vulnerability exists in the `mintplex-labs/anything-llm` application, specifically within the username parameter during the login process at the `/api/request-token` endpoint. The vulnerability arises from improper handling of values, allowing attackers to perform brute force attacks without prior knowledge of the username. Once the password is known, attackers can conduct blind attacks to ascertain the full username, significantly compromising system security.

Affected products (as reported)

Vendor	Product	Versions
mintplex-labs	mintplex-labs/anything-llm	unspecified – before 1.0.0

Weakness: CWE-307 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In plain English

Official description

Affected products (as reported)

References