Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03cDJnLTJ2eGMtNWc1Nc4ABCyb

Letta (previously MemGPT) incorrect access control vulnerability

Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data.

Permalink: https://github.com/advisories/GHSA-7p2g-2vxc-5g55
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03cDJnLTJ2eGMtNWc1Nc4ABCyb
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 12 days ago
Updated: 6 days ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00043
EPSS Percentile: 0.1094

Identifiers: GHSA-7p2g-2vxc-5g55, CVE-2024-39025
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-39025
• https://github.com/letta-ai/letta/releases/tag/0.3.17
• https://medium.com/@cnetsec/a-vulnerability-cve-2024-39025-has-been-identified-in-lettaai-memgpt-v0-3-17-146cb38bb6db
• https://github.com/letta-ai/letta/blob/0.3.17/memgpt/server/rest_api/admin/users.py#L55-L68
• https://github.com/advisories/GHSA-7p2g-2vxc-5g55

Repository: https://github.com/letta-ai/letta
Blast Radius: 1.0

Affected Packages