漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences
Vulnerability Description
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The two generic system-preferences endpoints allow manager role access, while every other surface that touches the same settings is restricted to admin only. Because of this inconsistency, a manager can call the generic endpoints directly to read plaintext SQL database credentials and overwrite admin-only global settings such as the default system prompt and the Community Hub API key.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Vulnerability Type
授权机制不正确
Vulnerability Title
AnythingLLM 安全漏洞
Vulnerability Description
AnythingLLM是Mintplex开源的一个一体化AI应用程序。 AnythingLLM 1.11.1及之前版本存在安全漏洞，该漏洞源于两个通用系统偏好设置端点允许管理器角色访问，可能导致管理器读取明文SQL数据库凭据并覆盖仅限管理员访问的全局设置。
CVSS Information
N/A
Vulnerability Type
N/A