ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2024-10109

PoC —
CVSS 3.0
8.3 high
EPSS
<1%p42
Published
()
Modified
Description

A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of service on chats.

Vendors
mintplexlabs
Products
anythingllm
Weakness
CWE-863
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news

No ingested article mentions this CVE yet.