Unauthorized Access Vulnerability in Anything-LLM by Mintplex Labs

CVE-2024-6842

What is CVE-2024-6842?

In version 1.5.5 of Mintplex Labs’ Anything-LLM, the /setup-complete API endpoint is susceptible to unauthorized access, allowing attackers to retrieve sensitive system settings. The currentSettings function returns critical data, including API keys for search engines. This exposure can enable malicious actors to exploit these keys, potentially leading to the theft of user assets and essential resources. It's imperative for users to secure their systems against this vulnerability to mitigate risks related to unauthorized access and data leakage.

References