Vulnerability Description
An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes. This flaw allows unauthenticated users to perform destructive actions on the VectorDB, including resetting the database and deleting specific namespaces, without requiring any authorization or permissions. The issue affects all versions up to and including the latest version, with a fix introduced in version 1.0.0. Exploitation of this vulnerability can lead to complete data loss of document embeddings across all workspaces, rendering workspace chats and embeddable chat widgets non-functional. Additionally, attackers can list all namespaces, potentially exposing private workspace names.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mintplexlabs | Anythingllm | < 1.0.0 |
Related Weaknesses (CWE)
References
- https://github.com/mintplex-labs/anything-llm/commit/bf8df60c02b9ddc7ba682809ca1Patch
- https://huntr.com/bounties/8a98a0b4-7886-41c5-8624-fc5c21972e5aExploitThird Party Advisory
- https://github.com/mintplex-labs/anything-llm/commit/bf8df60c02b9ddc7ba682809ca1Patch
- https://huntr.com/bounties/8a98a0b4-7886-41c5-8624-fc5c21972e5aExploitThird Party Advisory
FAQ
What is CVE-2024-3033?
CVE-2024-3033 is a vulnerability with a CVSS score of 9.4 (CRITICAL). An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes. This flaw allows unauthenticated users to p...
How severe is CVE-2024-3033?
CVE-2024-3033 has been rated CRITICAL with a CVSS base score of 9.4/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-3033?
Check the references section above for vendor advisories and patch information. Affected products include: Mintplexlabs Anythingllm.