CVE-2024-0436

Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack given the linear nature of the `!==` used for comparison. The risk is minified by the additional overhead of the request, which varies in a non-constant nature making the attack less reliable to execute

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mintplex-labs/anything-llm/commit/3c859ba3038121b67fb98e87dc52617fa27cbef0	Patch
https://huntr.com/bounties/3e73cb96-c038-46a1-81b7-4d2215b36268	Third Party Advisory
https://github.com/mintplex-labs/anything-llm/commit/3c859ba3038121b67fb98e87dc52617fa27cbef0	Patch
https://huntr.com/bounties/3e73cb96-c038-46a1-81b7-4d2215b36268	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*

History

27 Mar 2025, 11:15

Type	Values Removed	Values Added
CWE	~~CWE-764~~	CWE-203
First Time		Mintplexlabs anythingllm Mintplexlabs
References	~~() https://github.com/mintplex-labs/anything-llm/commit/3c859ba3038121b67fb98e87dc52617fa27cbef0 -~~	() https://github.com/mintplex-labs/anything-llm/commit/3c859ba3038121b67fb98e87dc52617fa27cbef0 - Patch
References	~~() https://huntr.com/bounties/3e73cb96-c038-46a1-81b7-4d2215b36268 -~~	() https://huntr.com/bounties/3e73cb96-c038-46a1-81b7-4d2215b36268 - Third Party Advisory
CPE		cpe:2.3:a:mintplexlabs:anythingllm::::::::
Summary	(en) Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack given the linear nature of the `!==` used for comparison. The risk is minified by the additional overhead of the request, which varies in a non-constant nature making the attack less reliable to execute	(en) Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack given the linear nature of the `!==` used for comparison. The risk is minified by the additional overhead of the request, which varies in a non-constant nature making the attack less reliable to execute
CVSS	v2 : ~~unknown~~ v3 : ~~7.1~~	v2 : unknown v3 : 5.9

21 Nov 2024, 08:46

Type	Values Removed	Values Added
References	~~() https://github.com/mintplex-labs/anything-llm/commit/3c859ba3038121b67fb98e87dc52617fa27cbef0 -~~	() https://github.com/mintplex-labs/anything-llm/commit/3c859ba3038121b67fb98e87dc52617fa27cbef0 -
References	~~() https://huntr.com/bounties/3e73cb96-c038-46a1-81b7-4d2215b36268 -~~	() https://huntr.com/bounties/3e73cb96-c038-46a1-81b7-4d2215b36268 -
Summary		(es) En teoría, sería posible que un atacante aplicara fuerza bruta a la contraseña de una instancia en modo de protección de contraseña de usuario único mediante un ataque de sincronización dada la naturaleza lineal del `!==` usado para la comparación. El riesgo se minimiza por la sobrecarga adicional de la solicitud, que varía de forma no constante, lo que hace que el ataque sea menos confiable de ejecutar.

26 Feb 2024, 16:32

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-26 16:27

Updated : 2025-03-27 11:15

NVD link : CVE-2024-0436

Mitre link : CVE-2024-0436

CVE.ORG link : CVE-2024-0436

JSON object : View

Products Affected

mintplexlabs

anythingllm

CWE

CWE-203

Observable Discrepancy

{"id": "CVE-2024-0436", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2024-02-26T16:27:50.283", "references": [{"url": "https://github.com/mintplex-labs/anything-llm/commit/3c859ba3038121b67fb98e87dc52617fa27cbef0", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/3e73cb96-c038-46a1-81b7-4d2215b36268", "tags": ["Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://github.com/mintplex-labs/anything-llm/commit/3c859ba3038121b67fb98e87dc52617fa27cbef0", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://huntr.com/bounties/3e73cb96-c038-46a1-81b7-4d2215b36268", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-203"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack given the linear nature of the `!==` used for comparison.\n\nThe risk is minified by the additional overhead of the request, which varies in a non-constant nature making the attack less reliable to execute"}, {"lang": "es", "value": "En teor\u00eda, ser\u00eda posible que un atacante aplicara fuerza bruta a la contrase\u00f1a de una instancia en modo de protecci\u00f3n de contrase\u00f1a de usuario \u00fanico mediante un ataque de sincronizaci\u00f3n dada la naturaleza lineal del `!==` usado para la comparaci\u00f3n. El riesgo se minimiza por la sobrecarga adicional de la solicitud, que var\u00eda de forma no constante, lo que hace que el ataque sea menos confiable de ejecutar."}], "lastModified": "2025-03-27T11:15:35.710", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D667E32-5A5C-479C-BB81-47F3BCA38C13", "versionEndExcluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}

5.9 /10