CVE-2024-6842CWE-306

Exposure of Sensitive Information in mintplex-labs/anything-llm

High · published March 20, 2025

CVSS v3.0

7.5

EPSS

31%

Percentile

98.3

In the wild

Unconfirmed

What it is

In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.

The record

Technical detail

CVSS v3.0: 7.5 · HIGH
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.31102 · 98.3th percentile
Weakness: CWE-306 · Missing Authentication for Critical Function
Published: 2025-03-20T10:10Z

EPSS history

Timeline

20 MAR 10:10Z
Exposure of Sensitive Information in mintplex-labs/anything-llm
cvelistv5