CVE-2024-0436

Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack given the linear nature of the `!==` used for comparison. The risk is minified by the additional overhead of the request, which varies in a non-constant nature making the attack less reliable to execute

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mintplex-labs/anything-llm/commit/3c859ba3038121b67fb98e87dc52617fa27cbef0	Patch
https://huntr.com/bounties/3e73cb96-c038-46a1-81b7-4d2215b36268	Third Party Advisory
https://github.com/mintplex-labs/anything-llm/commit/3c859ba3038121b67fb98e87dc52617fa27cbef0	Patch
https://huntr.com/bounties/3e73cb96-c038-46a1-81b7-4d2215b36268	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-02-26 16:27

Updated : 2025-03-27 11:15

NVD link : CVE-2024-0436

Mitre link : CVE-2024-0436

CVE.ORG link : CVE-2024-0436

JSON object : View

Products Affected

mintplexlabs

anythingllm

CWE

CWE-203

Observable Discrepancy

{"id": "CVE-2024-0436", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2024-02-26T16:27:50.283", "references": [{"url": "https://github.com/mintplex-labs/anything-llm/commit/3c859ba3038121b67fb98e87dc52617fa27cbef0", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://huntr.com/bounties/3e73cb96-c038-46a1-81b7-4d2215b36268", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://github.com/mintplex-labs/anything-llm/commit/3c859ba3038121b67fb98e87dc52617fa27cbef0", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://huntr.com/bounties/3e73cb96-c038-46a1-81b7-4d2215b36268", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-203"}]}, {"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack given the linear nature of the `!==` used for comparison.\n\nThe risk is minified by the additional overhead of the request, which varies in a non-constant nature making the attack less reliable to execute"}, {"lang": "es", "value": "En teor\u00eda, ser\u00eda posible que un atacante aplicara fuerza bruta a la contrase\u00f1a de una instancia en modo de protecci\u00f3n de contrase\u00f1a de usuario \u00fanico mediante un ataque de sincronizaci\u00f3n dada la naturaleza lineal del `!==` usado para la comparaci\u00f3n. El riesgo se minimiza por la sobrecarga adicional de la solicitud, que var\u00eda de forma no constante, lo que hace que el ataque sea menos confiable de ejecutar."}], "lastModified": "2025-03-27T11:15:35.710", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D667E32-5A5C-479C-BB81-47F3BCA38C13", "versionEndExcluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}