AVID-2026-R1356

Description

Download and export of file via default user role (CVE-2024-0551)

Details

Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access to the system prior to the attack.

It is worth noting that the deterministic nature of the export name is lower risk as the UI for exporting would start the download at the same time, which once downloaded - deletes the export from the system.

The endpoint for exporting should simply be patched to a higher privilege level.

Reason for inclusion in AVID: The CVE describes improper access control enabling export of database data via the default user role, leading to potential data exfiltration. The affected artifact is mintplex-labs/anything-llm, an AI system component, implying relevance to AI software stacks and pipelines. This constitutes a software supply-chain vulnerability within AI systems (data exposure via a component used to build/deploy AI). The vulnerability is security-related (data leakage due to insufficient access control) and the report provides explicit evidence (CVE entry, description, affected artifacts).

References

Affected or Relevant Artifacts

Developer: mintplex-labs
Deployer: mintplex-labs
Artifact Details:

Type	Name
System	mintplex-labs/anything-llm

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.0
Vector String	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Base Score	7.1
Base Severity	🔴 High
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	🟢 Low
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🟢 Low
Availability Impact	NONE

CWE

ID	Description
CWE-284	CWE-284 Improper Access Control

Other information

Report Type: Advisory
Credits:
Date Reported: 2024-02-27
Version: 0.3.3
AVID Entry