CVE-2024-6842
HIGH NUCLEImintplex-labs/anything-llm <1.5.5 - Info Disclosure
Title source: llmExploitation Summary
CVE-2024-6842 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.
Description
In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
Nuclei Templates (1)
AnythingLLM - Information Disclosure
HIGHVERIFIEDby ingbunga,rahaaaiii,asteria121,breakpack,gy741
Shodan:
title:"AnythingLLM"
References (2)
Core 2
Core References
Exploit, Third Party Advisory
https://huntr.com/bounties/cd911fc7-ac6b-4974-acd0-9cc926fa8d9e
Scores
CVSS v3
7.5
EPSS
0.2949
EPSS Percentile
97.9%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-306
Status
published
Products (1)
mintplexlabs/anythingllm
1.5.5
Published
Mar 20, 2025
Tracked Since
Feb 18, 2026