Vulnerability Details CVE-2024-10513
A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the 'manager' role to access and manipulate the 'anythingllm.db' database file. By exploiting the vulnerable endpoint '/api/document/move-files', an attacker can move the database file to a publicly accessible directory, download it, and subsequently delete it. This can lead to unauthorized access to sensitive data, privilege escalation, and potential data loss.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 37.7%
CVSS Severity
CVSS v3 Score 7.2
References
Products affected by CVE-2024-10513
-
cpe:2.3:a:mintplexlabs:anythingllm:-
-
cpe:2.3:a:mintplexlabs:anythingllm:0.0.1
-
cpe:2.3:a:mintplexlabs:anythingllm:0.1.0
-
cpe:2.3:a:mintplexlabs:anythingllm:1.0.0
-
cpe:2.3:a:mintplexlabs:anythingllm:1.1.0
-
cpe:2.3:a:mintplexlabs:anythingllm:1.1.1
-
cpe:2.3:a:mintplexlabs:anythingllm:1.2.0
-
cpe:2.3:a:mintplexlabs:anythingllm:1.2.1