CVE-2024-0765
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Published Mar 3, 2024
Updated: Jan 8, 2025
CWE ID 200
Summary
CVE-2024-0765 is a vulnerability in AnythingLLM's multi-user instance where a default user can export data through the `/export-data` endpoint. By executing this call, an attacker can unzip and exfiltrate data from the system. This action does not leave any trace behind as the data is deleted post-download. An attacker needs explicit access to the system to exploit this vulnerability.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Mintplex Labs