CVE-2024-7783

published 2024-10-29

CVE-2024-7783: mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT…

Priority P3 42 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSON Web Token) used as a bearer token in single user mode. When decoded, the JWT reveals the password in plaintext. This improper storage of sensitive information poses significant security risks, as an attacker who gains access to the JWT can easily decode it and retrieve the password. The issue is fixed in version 1.0.3.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mintplex-labs	mintplex-labs_anything-llm	>= unspecified < 1.0.3	1.0.3
mintplexlabs	anythingllm	< 1.2.1	1.2.1

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v3.0 5.9 MEDIUM CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-312