Description
In mintplex-labs/anything-llm, a vulnerability exists due to improper input validation in the workspace update process. Specifically, the application fails to validate or format JSON data sent in an HTTP POST request to `/api/workspace/:workspace-slug/update`, allowing it to be executed as part of a database query without restrictions. This flaw enables users with a manager role to craft a request that includes nested write operations, effectively allowing them to create new Administrator accounts.
INFO
Published Date :
2024-05-20T12:24:51.682Z
Last Modified :
2024-08-01T20:33:53.198Z
Source :
@huntr_ai
AFFECTED PRODUCTS
The following products are affected by CVE-2024-4287 vulnerability.
| Vendors | Products |
|---|---|
| Mintplexlabs |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2024-4287.
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact