High severity · published Mar 20, 2025
CVE-2024-6842
Exposure of Sensitive Information in mintplex-labs/anything-llm
7.5
CVSS
36.3%
EPSS
No
On KEV
Description
In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)36.3% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
mintplex-labs/anything-llm · mintplex-labs
before 1.0.2 · source: vendor
AN
Anythingllm · Mintplexlabs
1.5.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6842
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6842
Patch
https://github.com/mintplex-labs/anything-llm/commit/8b1ceb30c159cf3a10efa16275bc6849d84e4ea8
Exploit
https://huntr.com/bounties/cd911fc7-ac6b-4974-acd0-9cc926fa8d9e
More from mintplex-labs/anything-llm
9.9
CVE-2024-3025
Path Traversal in mintplex-labs/anything-llm
9.8
CVE-2024-8196
Missing Authentication for Critical Function in mintplex-labs/anything-llm
9.8
CVE-2024-3104
Remote Code Execution in mintplex-labs/anything-llm
9.8
CVE-2023-4897
Relative Path Traversal in mintplex-labs/anything-llm
9.6
CVE-2024-3166
Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm