← Back

CVE-2024-13060

nvd nist
Published: Mar 20, 2025Modified: Jun 17, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1.

Affected (1)

Mintplexlabs
1 product
Anythingllm Docker
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Anythingllm Docker
Before 1.3.1

Related CWEs

CWE-862
Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

Source: security@huntr.dev
Patch
Source: security@huntr.dev
Exploit
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Exploit

Timeline

No history available yet.