CVE-2024-0550
Medium
Description
A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files. The attacker would have to have been granted privileged permissions to the system before executing this attack.
SeverityMedium
CVSS6.5
Exploit probability—
ProductMintplexlabs Anythingllm
PublishedFeb 28, 2024
First seenFeb 28, 2024
Weakness typeCWE-23CWE-23
How to fix
Update
- mintplexlabs anythingllm1.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mintplexlabs anythingllm | v < 1.0.0 | 1.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.