CVE-2024-6842 is an information disclosure vulnerability in mintplex-labs/anything-llm version 1.5.5, allowing unauthorized access to sensitive system settings via the /setup-complete API endpoint. This flaw exposes critical data like search engine API keys, enabling attackers to steal these credentials and potentially compromise user assets. With a CVSS score of 7.5 (HIGH) and an EPSS percentile of 98.743%, the vulnerability is easily exploitable over the network without authentication or user interaction, leading to high confidentiality impact. While not yet in the KEV catalog, Nuclei templates exist for detection, and the vulnerability has garnered significant community discussion, indicating potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.5.5CPE matchmatch criteria | cpe:2.3:a:mintplexlabs:anythingllm:1.5.5:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.