CVE-2024-6842
Exposure of Sensitive Information in mintplex-labs/anything-llm
Résumé
Exposure of Sensitive Information in mintplex-labs/anything-llm
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In version 1.5.5 of mintplex-labs/anything-llm, the /setup-complete API endpoint allows unauthorized users to access sensitive system settings. The data returned by the currentSettings function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
Références
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com