CVE-2024-6842
Exposure of Sensitive Information in mintplex-labs/anything-llm
概要
Exposure of Sensitive Information in mintplex-labs/anything-llm
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In version 1.5.5 of mintplex-labs/anything-llm, the /setup-complete API endpoint allows unauthorized users to access sensitive system settings. The data returned by the currentSettings function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com