CVE-2024-0550

published 2024-02-28

CVE-2024-0550: A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API…

Priority P3 40 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files.

The attacker would have to have been granted privileged permissions to the system before executing this attack.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mintplex-labs	mintplex-labs_anything-llm	>= unspecified < 1.0.0	1.0.0
mintplexlabs	anythingllm	< 1.0.0	1.0.0

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvd v3.0 9.6 CRITICAL CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-23