Vulnerability · Published Dec 11, 2023 · Assigned by GitHub_M
CVE-2023-49795MindsDB Server-Side Request Forgery vulnerability
Medium 6.5
In plain English
A medium-severity server-side request forgery in mindsdb from mindsdb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnerability in `file.py`. This can lead to limited information disclosure. Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | mindsdb | 23.11.4.1 | GHSA-34mr-6q8x-g9r6 |
| PyPI | mindsdb | 23.11.4.1 | PYSEC-2023-277 |
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N