Advisories · Technology

mintplex-labs/anything-llm.

Every CVE that names mintplex-labs/anything-llm among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2024-0550 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Privileged User using traversal to read system files
- mintplex-labs/anything-llm
- Path traversal
Not analysed yet 28 Feb 2024
CVE-2024-0763 CVE record

CVSS 8.1 High

Improper validation of document removal parameter
- mintplex-labs/anything-llm
- Path traversal
Not analysed yet 27 Feb 2024
CVE-2024-0551 CVE record

CVSS 7.1 High

Download and export of file via default user role
- mintplex-labs/anything-llm
- Broken access control
Not analysed yet 27 Feb 2024
CVE-2024-0759 CVE record

CVSS 7.7 High

Collection of internally resolving IPs
- mintplex-labs/anything-llm
- Server-side request forgery (SSRF)
Not analysed yet 27 Feb 2024
CVE-2024-0439 CVE record

CVSS 7.1 High

User can manually send request at manager permission to modify system configurations
- mintplex-labs/anything-llm
- Privilege escalation
Not analysed yet 25 Feb 2024
CVE-2024-0440 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

SSRF - file:// unsanitized access to underlying host files
- mintplex-labs/anything-llm
- Server-side request forgery (SSRF)
Not analysed yet 25 Feb 2024
CVE-2024-0435 CVE record

CVSS 8.1 High

User can submit message to self-XSS
- mintplex-labs/anything-llm
- Cross-site scripting (XSS)
Not analysed yet 25 Feb 2024
CVE-2024-0798 CVE record

CVSS 8.1 High

Privilege Escalation in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- CWE-272
Not analysed yet 25 Feb 2024
CVE-2024-0436 CVE record

CVSS 7.1 High

Prevent timing attack for single-user password check
- mintplex-labs/anything-llm
- Information disclosure
Not analysed yet 25 Feb 2024
CVE-2024-0455 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

SSRF on AWS deployed instances of AnythingLLM via /metadata
- mintplex-labs/anything-llm
- Server-side request forgery (SSRF)
Not analysed yet 25 Feb 2024
CVE-2024-22422 CVE record

CVSS 7.5 High

Unauthenticated Denial of Service (DOS) attack in AnythingLLM
- Mintplex-Labs anything-llm
- CWE-754
Not analysed yet 19 Jan 2024
CVE-2023-5833 CVE record

CVSS 8.1 High

Improper Access Control in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Broken access control
Not analysed yet 30 Oct 2023
CVE-2023-5832 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Improper Input Validation in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- CWE-20
Not analysed yet 30 Oct 2023
CVE-2023-4899 CVE record

CVSS 8.1 High

SQL Injection in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- SQL injection
Not analysed yet 11 Sept 2023
CVE-2023-4898 CVE record

CVSS 8.2 High

Authentication Bypass by Primary Weakness in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- CWE-305
Not analysed yet 11 Sept 2023
CVE-2023-4897 CVE record

CVSS 8.7 High

Relative Path Traversal in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Path traversal
Not analysed yet 11 Sept 2023