CVE-2024-13060

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-13060

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-13060.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-13060

Published

2025-03-20T10:08:46.465Z

Modified

2026-07-15T01:49:01.048419018Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Improper Authorization in mintplex-labs/anything-llm

Details

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13060.json",
    "cna_assigner": "@huntr_ai",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "1.3.1"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-862"
    ]
}

References

Affected packages

Git / github.com/mintplex-labs/anything-llm

Affected ranges

Type

GIT

Repo

https://github.com/mintplex-labs/anything-llm

Events

Introduced

Fixed

696af19c45473172ad4d3ca749281800a4d1a45a

Database specific

{
    "source": "REFERENCES"
}

Affected versions

v1.*

v1.0.0

v1.1.0

v1.1.1

v1.2.0

v1.2.1

v1.2.2

v1.2.3

v1.3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-13060.json"