CVE-2024-0763
Assigner: @huntr_ai
Published: 2024-02-27T21:14:56.552Z
State: PUBLISHED
title: Improper validation of document removal parameter
descriptions: value: Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attacker would need access to the server at some privilege level since this endpoint is protected and requires authorization.
affected: vendor: mintplex-labs
product: mintplex-labs/anything-llm
versions: version: unspecified
lessThan: 1.0.0
status: affected
versionType: custom
metrics: cvssV3_0: version: 3.0
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
baseScore: 8.1
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-20 Improper Input Validation
cweId: CWE-20
source: advisory: 25a2f487-5a9c-4c7f-a2d3-b0527db73ea5
discovery: EXTERNAL