Medium severity · published Mar 20, 2025
CVE-2024-13060
Improper Authorization in mintplex-labs/anything-llm
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
mintplex-labs/anything-llm · mintplex-labs
before 1.3.1 · source: vendor
AD
Anythingllm Docker · Mintplexlabs
before 1.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-13060
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-13060
Patch
https://github.com/mintplex-labs/anything-llm/commit/696af19c45473172ad4d3ca749281800a4d1a45a
Exploit
https://huntr.com/bounties/98a49c90-e095-441f-900c-59d463dc8e8f
More from mintplex-labs/anything-llm
9.9
CVE-2024-3025
Path Traversal in mintplex-labs/anything-llm
9.8
CVE-2024-8196
Missing Authentication for Critical Function in mintplex-labs/anything-llm
9.8
CVE-2024-3104
Remote Code Execution in mintplex-labs/anything-llm
9.8
CVE-2023-4897
Relative Path Traversal in mintplex-labs/anything-llm
9.6
CVE-2024-3166
Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm