CVE-2024-6842

HIGH NUCLEI

mintplex-labs/anything-llm <1.5.5 - Info Disclosure

Title source: llm

Description

In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.

Nuclei Templates (1)

AnythingLLM - Information Disclosure
HIGHVERIFIEDby ingbunga,rahaaaiii,asteria121,breakpack,gy741
Shodan: title:"AnythingLLM"

References (2)

Scores

CVSS v3 7.5
EPSS 0.7732
EPSS Percentile 99.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-306
Status published
Products (1)
mintplexlabs/anythingllm 1.5.5
Published Mar 20, 2025
Tracked Since Feb 18, 2026