Description

AnythingLLM is a full-stack app allowing you to build a private ChatGPT using commercial or open-source LLMs and vectorDB solutions, both locally and remotely, for intelligent document chat.

Acunetix determined that it was possible to access AnythingLLM API without authentication.

Remediation

Enable authentication for AnythingLLM

References

AnythingLLM Documentation

Related Vulnerabilities

Vanilla Forums Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3613)

Plone CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-21336)

GraphQL Introspection Query Enabled

GraphQL Array-based Query Batching Allowed: Potential Batching Attack Vulnerability

WordPress 5.1.x Multiple Vulnerabilities (5.1 - 5.1.8)

Severity

Medium

Classification

CVE-2024-6842 CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Configuration