How severe is CVE-2024-3283?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.2 out of 10.

What type of vulnerability is CVE-2024-3283?

This is classified as CWE-915, which is a common weakness in software security.

CVE-2024-3283 - HIGH Severity | CVSS 7.2

Vulnerability Description

A vulnerability in mintplex-labs/anything-llm allows users with manager roles to escalate their privileges to admin roles through a mass assignment issue. The '/admin/system-preferences' API endpoint improperly authorizes manager-level users to modify the 'multi_user_mode' system variable, enabling them to access the '/api/system/enable-multi-user' endpoint and create a new admin user. This issue results from the endpoint accepting a full JSON object in the request body without proper validation of modifiable fields, leading to unauthorized modification of system settings and subsequent privilege escalation.

Related Vulnerabilities

CVE-2021-32807

HIGH

CVSS:7.2(High)

The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the c...

CWE-9152021

CVE-2021-32811

HIGH

CVSS:7.2(High)

Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope ...

CWE-9152021

CVE-2022-48359

HIGH

CVSS:7.5(High)

The recovery mode for updates has a vulnerability that causes arbitrary disk modification. Successful exploitation of this vulnerability may affect confidentiality.

CWE-9152022

CVE-2025-31674

HIGH

CVSS:7.5(High)

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, fr...

CWE-9152025

CVE-2022-4068

HIGH

CVSS:7.6(High)

A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This ...

CWE-9152022

CVE-2021-21297

MEDIUM

CVSS:6.5(Medium)

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request ca...

CWE-9152021