CVE-2024-5208CWE-770

Uncontrolled Resource Consumption in mintplex-labs/anything-llm

Medium · published June 19, 2024

CVSS v3.0
6.5
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

An uncontrolled resource consumption vulnerability exists in the `upload-link` endpoint of mintplex-labs/anything-llm. This vulnerability allows attackers to cause a denial of service (DOS) by shutting down the server through sending invalid upload requests. Specifically, the server can be made to shut down by sending an empty body with a 'Content-Length: 0' header or by sending a body with arbitrary content, such as 'asdasdasd', with a 'Content-Length: 9' header. The vulnerability is reproducible by users with at least a 'Manager' role, sending a crafted request to any workspace. This issue indicates that a previous fix was not effective in mitigating the vulnerability.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00618 · 49.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2024-06-19T06:13Z
EPSS history
Timeline
  • 19 JUN 06:13Z
    Uncontrolled Resource Consumption in mintplex-labs/anything-llm
    cvelistv5