CVE-2024-0759

    Dashboard / Vulnerabilities / CVE-2024-0759

    CVE-2024-0759

    Published: 27 Feb 2024Last Modified: 12 Aug 2026

    Summary: Collection of internally resolving IPs

    Details: Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM. This would require the attacker also be able to guess these internal IPs as `/*` ranging is not possible, but could be brute forced. There is a duty of care that other services on the same network would not be fully open and accessible via a simple CuRL with zero authentication as it is not possible to set headers or access via the link collector.

    References: https://huntr.com/bounties/9a978edd-ac94-41fc-8e3e-c35441bdd12b, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0759.json, https://nvd.nist.gov/vuln/detail/CVE-2024-0759, https://github.com/mintplex-labs/anything-llm/commit/0db6c3b2aa1787a7054ffdaba975474f122c20eb

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -013c0b9575ae6a87af87275e326041c4e0afeeee

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-0759 | CVE-DB