1. Home
  2. CVE Database
  3. CVE-2024-0550
MEDIUM · 6.5

CVE-2024-0550

A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files. The attack...

Vulnerability Description

A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files. The attacker would have to have been granted privileged permissions to the system before executing this attack.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
MintplexlabsAnythingllm< 1.0.0

Related Weaknesses (CWE)

CWE-23

References

FAQ

What is CVE-2024-0550?

CVE-2024-0550 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files. The attack...

How severe is CVE-2024-0550?

CVE-2024-0550 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-0550?

Check the references section above for vendor advisories and patch information. Affected products include: Mintplexlabs Anythingllm.