CVE-2024-13060
CVSS 3.1 Score 4.3 of 10 (medium)
Details
Published Mar 20, 2025
Updated: Apr 1, 2025
CWE ID 285
Summary
CVE-2024-13060 is a vulnerability affecting AnythingLLM Docker before version 1.3.1. Users with default permissions can exploit this issue by manipulating the 'id' parameter in the user cookie, granting unauthorized access to other users' profile pictures. This security flaw poses a risk to data privacy and could potentially lead to further unintended actions. Users are strongly encouraged to update their Docker installations to version 1.3.1 or above to mitigate this vulnerability.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Mintplex Labs