← Back

CVE-2024-6842

nvd nistnuclei
Published: Mar 20, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: security@huntr.dev (Secondary)

Description

In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.

Affected (1)

Mintplexlabs
1 product
Anythingllm
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Anythingllm
Version 1.5.5

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

Source: security@huntr.dev
Patch
Source: security@huntr.dev
ExploitThird Party Advisory

Timeline

No history available yet.