← Back

CVE-2024-8196

nvd nist
Published: Mar 20, 2025Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: security@huntr.dev (Secondary)

Description

In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace.

Affected (1)

Mintplexlabs
1 product
Anythingllm Desktop
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Anythingllm Desktop
Before 1.6.5
Running on/withPlatform Versions
Microsoft
Windows
All versions

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

Source: security@huntr.dev
Patch
Source: security@huntr.dev
ExploitThird Party Advisory

Timeline

No history available yet.