CVE-2024-3101

In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escalate privileges by deactivating 'Multi-User Mode'. By sending a specially crafted curl request with the 'multi_user_mode' parameter set to false, an attacker can deactivate 'Multi-User Mode'. This action permits the creation of a new admin user without requiring a password, leading to unauthorized administrative access.
Configurations

Configuration 1 (hide)

cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*

History

09 Jul 2025, 19:49

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : 6.7
v2 : unknown
v3 : 7.2
References () https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2 - () https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2 - Patch
References () https://huntr.com/bounties/c114c03e-3348-450f-88f7-538502047bcc - () https://huntr.com/bounties/c114c03e-3348-450f-88f7-538502047bcc - Exploit, Third Party Advisory
CPE cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*
First Time Mintplexlabs
Mintplexlabs anythingllm

21 Nov 2024, 09:28

Type Values Removed Values Added
Summary
  • (es) En mintplex-labs/anything-llm, una vulnerabilidad de validación de entrada incorrecta permite a los atacantes aumentar los privilegios desactivando el "Modo multiusuario". Al enviar una solicitud curl especialmente manipulada con el parámetro "multi_user_mode" establecido en falso, un atacante puede desactivar el "Modo multiusuario". Esta acción permite la creación de un nuevo usuario administrador sin necesidad de una contraseña, lo que conduce a un acceso administrativo no autorizado.
References () https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2 - () https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2 -
References () https://huntr.com/bounties/c114c03e-3348-450f-88f7-538502047bcc - () https://huntr.com/bounties/c114c03e-3348-450f-88f7-538502047bcc -

10 Apr 2024, 17:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-04-10 17:15

Updated : 2025-07-09 19:49


NVD link : CVE-2024-3101

Mitre link : CVE-2024-3101

CVE.ORG link : CVE-2024-3101


JSON object : View

Products Affected

mintplexlabs

  • anythingllm
CWE
CWE-20

Improper Input Validation

NVD-CWE-noinfo