CVE-2024-0550
Privileged User using traversal to read system files
- State
- Published
- Severity
- 9.6 Critical
- Published
- Feb 28, 2024
- Updated
- Aug 22, 2024
- Reserved
- Jan 15, 2024
Description
A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files.
The attacker would have to have been granted privileged permissions to the system before executing this attack.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 9.6 Critical | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N | @huntr_ai |
Weaknesses
- CWE-23 Relative Path Traversal
Affected Products
| Product | Versions |
|---|---|
mintplex-labs/anything-llmmintplex-labs |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.