CVE-2024-0549

CVSS V2 None CVSS V3 None

Description

mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input validation and normalization in the handling of file and folder deletion requests. Successful exploitation results in the compromise of data integrity and availability.

Overview

CVE ID
CVE-2024-0549

Assigner
@huntr_ai

Vulnerability Status
PUBLISHED

Published Version
2024-04-16T00:00:14.132Z

Last Modified Date
2024-04-16T11:10:49.469Z

Weakness Enumerations

CWE	URL
CWE-23	http://cwe.mitre.org/data/definitions/23.html

References

Reference URL	Reference Tags
https://huntr.com/bounties/fcb4001e-0290-4b78-a2f0-91ee5d20cc72
https://github.com/mintplex-labs/anything-llm/commit/026849df0224b6a8754f4103530bc015874def62

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-0549
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0549

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 10:31:18				Added to TrackCVE