CVE-2023-4898 : Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/any

Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.

Published 2023-09-12 00:15:10

Updated 2023-09-13 03:47:34

Source huntr.dev

View at NVD, CVE.org

Products affected by CVE-2023-4898

Mintplexlabs » Anything-llm
Versions before (<) 0.0.1
cpe:2.3:a:mintplexlabs:anything-llm:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.18%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.2	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N	3.9	4.2	huntr.dev
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: Low Availability: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-305 Authentication Bypass by Primary Weakness

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Assigned by: security@huntr.dev (Secondary)

https://github.com/mintplex-labs/anything-llm/commit/dc3dfbf31495fe316b21ee184b9317b38101d30e

patch SQL injection opportunities [LOW RISK] (#234) · Mintplex-Labs/anything-llm@dc3dfbf · GitHub
Patch

CVEs referencing this url
https://huntr.dev/bounties/a3dda692-7e8a-44a9-bd96-24cfd3f721d2

SQL injection and Authentication bypass vulnerability found in anything-llm
Exploit;Third Party Advisory

Jump to