VulnerabilityModified

CVE-2024-13060

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie.

MEDIUM 4.3EPSS 0.47%

Does this matter?

Lower severity and a low EPSS score (0.47%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.47% probability · 40th percentile
CISA KEV: Not listed
Weakness: CWE-862
Affected: mintplexlabs/anythingllm docker
Source: security@huntr.dev

References

https://github.com/mintplex-labs/anything-llm/commit/696af19c45473172ad4d3ca749281800a4d1a45aPatch
https://huntr.com/bounties/98a49c90-e095-441f-900c-59d463dc8e8fExploit
https://huntr.com/bounties/98a49c90-e095-441f-900c-59d463dc8e8fExploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.