漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Mass Assignment Vulnerability in mintplex-labs/anything-llm
Vulnerability Description
A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of high-privileged accounts. By intercepting and modifying the HTTP request during the account creation process via an invitation link, an attacker can add a `role` property with `admin` value, thereby gaining administrative access. This issue arises due to the lack of property allowlisting and blocklisting, enabling the attacker to exploit the system and perform actions as an administrator.
CVSS Information
N/A
Vulnerability Type
CWE-915
Vulnerability Title
AnythingLLM 安全漏洞
Vulnerability Description
AnythingLLM是符合业务要求的文档聊天机器人。 AnythingLLM 存在安全漏洞，该漏洞源于缺少黑白属性名单，允许攻击者未经授权创建高权限帐户。
CVSS Information
N/A
Vulnerability Type
N/A