CVE-2024-3102

CVE-2024-3102 is a JSON Injection vulnerability affecting mintplex-labs/anything-llm, specifically in the username parameter of the login process at the /api/request-token endpoint. This allows attackers to brute-force usernames without prior knowledge and, once a password is known, conduct blind attacks to determine the full username. Rated Medium severity with a CVSS score of 5.3, this vulnerability has a low attack complexity and no user interaction required, potentially leading to a compromise of confidentiality. The primary impact is information disclosure of usernames. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage.