Mintplex Labs/Anything Llm
Approved changes feed: RSS · Atom
cpe:2.3:a:mintplex-labs:mintplex-labs\/anything-llm:0.2.0:*:*:*:*:*:*:*
part: a version: 0.2.0 update: *
| Vendor | Mintplex Labs (e54a2d9f-d3cf-523b-bbb7-c499d4853e27) |
|---|---|
| Product | Mintplex Labs/Anything Llm (5e0c3059-b98c-5940-84dd-413931672f98) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-4084 |
vulnerable | 2026-06-08 06:50:17.001561 |
SSRF vulnerability in mintplex-labs/anything-llm
HIGH (7.7)
A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of mintplex-labs/anything-llm, allowing attackers to bypass the official fix intended to restrict access to intranet IP addresses and protocols. Despite efforts to filter out intranet IP addresses starting with 192, 172, 10, and 127 through regular expressions and limit access protocols to HTTP and HTTPS, attackers can still bypass these restrictions using alternative representations of IP addresses and accessing other ports running on localhost. This vulnerability enables attackers to access any asset on the internal network, attack web services on the internal network, scan hosts on the internal network, and potentially access AWS metadata endpoints. The vulnerability is due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.
Published: 2024-06-05T00:00:14.901Z
Updated: 2024-08-01T20:33:52.113Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.