Medium severity · published Feb 28, 2024
CVE-2024-0550
Privileged User using traversal to read system files
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files.
The attacker would have to have been granted privileged permissions to the system before executing this attack.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
mintplex-labs/anything-llm · mintplex-labs
before 1.0.0 · source: vendor
AN
Anythingllm · Mintplexlabs
before 1.0.0 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-0550
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-0550
Patch
https://github.com/mintplex-labs/anything-llm/commit/e1dcd5ded010b03abd6aa32d1bf0668a48e38e17
Exploit
https://huntr.com/bounties/c6afeb5e-f211-4b3d-aa4b-6bad734217a6
More from mintplex-labs/anything-llm
9.9
CVE-2024-3025
Path Traversal in mintplex-labs/anything-llm
9.8
CVE-2024-8196
Missing Authentication for Critical Function in mintplex-labs/anything-llm
9.8
CVE-2024-3104
Remote Code Execution in mintplex-labs/anything-llm
9.8
CVE-2023-4897
Relative Path Traversal in mintplex-labs/anything-llm
9.6
CVE-2024-3166
Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm