CVE-2024-7783
High
Description
mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSON Web Token) used as a bearer token in single user mode. When decoded, the JWT reveals the password in plaintext. This improper storage of sensitive information poses significant security risks, as an attacker who gains access to the JWT can easily decode it and retrieve the password. The issue is fixed in version 1.0.3.
SeverityHigh
CVSS7.5
Exploit probability—
ProductMintplexlabs Anythingllm
PublishedOct 29, 2024
First seenOct 29, 2024
Weakness typeCWE-312CWE-312
How to fix
Update
- mintplexlabs anythingllm1.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mintplexlabs anythingllm | v < 1.2.1 | 1.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.