AnythingLLM 资源管理错误漏洞

AnythingLLM is a document chatbot that meets business requirements. A resource management error vulnerability exists in AnythingLLM that stems from a denial of service DoS vulnerability when the application is run in just me mode using a password...

AnythingLLM 安全漏洞

AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in AnythingLLM that stems from allowing users with the Manager role to escalate their privileges to the Administrator role via a bulk assignment issue...

AnythingLLM 安全漏洞

AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in AnythingLLM that stems from insufficient validation of user-supplied input in the logo filename feature, which could lead to a path traversal attack...

PT-2024-26648 · Unknown · Anything-Llm

Name of the Vulnerable Software and Affected Versions: anything-llm affected versions not specified Description: A stored Cross-Site Scripting XSS vulnerability exists in the chat functionality, allowing attackers to execute arbitrary JavaScript in the context of a user's session. By manipulating...

CVE-2024-0765 Default user role exporting save state of instance

As a default user on a multi-user instance of AnythingLLM, you could execute a call to the /export-data endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state. This would require the attacked to be granted explicit acce...

CVE-2024-0765

The CVE-2024-0765 entry concerns AnythingLLM where a default user on a multi‑user instance can call the /export-data endpoint, unzip/read the export, and exfiltrate system data at the saved state. The vulnerability relies on export functionality accessible to users with explicit system access at ...

PT-2024-15802 · Unknown · Anything-Llm

Name of the Vulnerable Software and Affected Versions: AnythingLLM affected versions not specified Description: The issue allows a default user on a multi-user instance to execute a call to the "/export-data" endpoint, enabling them to exfiltrate data of the system at that save state. This requir...

AnythingLLM Information Disclosure Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM suffers from an information disclosure vulnerability that stems from allowing the default/manager user to obtain all system database information such as username, password, apikey, etc...

AnythingLLM Access Control Error Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM is vulnerable to an access control error vulnerability that stems from the presence of an access control error vulnerability...

AnythingLLM Security Vulnerability

AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in AnythingLLM. An attacker exploiting this vulnerability could set its profile picture via the front-end API using a relative file path and then download any valid file using the PFP GET API...

Authentication flaw

Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM. This would require the attacker also be...

CVE-2024-0759 Collection of internally resolving IPs

Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM. This would require the attacker also be...

AnythingLLM Access Control Error Vulnerability

AnythingLLM is a document chatbot that meets business requirements. An access control error vulnerability exists in AnythingLLM. An attacker could use this vulnerability to gain access to the system and export database information...

AnythingLLM Code Issue Vulnerability

AnythingLLM is a document chatbot that meets business requirements. A code issue vulnerability exists in AnythingLLM. An attacker could use this vulnerability to escalate privileges to brute force the IPs of other services located on the same network as AnythingLLM...

CVE-2024-0455

The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level manager, admin, and when in single user could put in the URL http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance which is a special IP and URL th...

AnythingLLM Code Issue Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM has a code issue vulnerability that stems from the presence of a server-side request forgery vulnerability. The vulnerability can be exploited to obtain AWS server data...

AnythingLLM Cross-Site Scripting Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM suffers from a cross-site scripting vulnerability that originates from injecting cross-site scripting into the chat box...

AnythingLLM Security Vulnerability

AnythingLLM is a business-compliant document chatbot. A security vulnerability exists in AnythingLLM that originates from a user with default privileges being able to delete documents uploaded by an administrator through certain actions...

PT-2024-15799 · Unknown · Anything-Llm

Name of the Vulnerable Software and Affected Versions: AnythingLLM affected versions not specified Description: If an instance of AnythingLLM is hosted on an internal network and the attacker is granted a permission level of manager or admin, they could link-scrape internally to resolve IPs of...

AnythingLLM Security Vulnerability

AnythingLLM is a business-compliant document chatbot. A security vulnerability exists in AnythingLLM that originates from a privilege management error in accounts with manager privileges...