CVE-2024-0765— AnythingLLM 信息泄露漏洞

Default user role exporting save state of instance

As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state. This would require the attacked to be granted explicit access to the system, but they can do this at any role. Additionally, post-download, the data is deleted so no evidence would exist that the exfiltration occured.

N/A

信息暴露

AnythingLLM 信息泄露漏洞

AnythingLLM是符合业务要求的文档聊天机器人。 AnythingLLM 存在信息泄露漏洞，该漏洞源于允许default/manager用户获取所有系统数据库信息，如用户名、密码、api_key等。

N/A

N/A