GitHub Advisoryadvisory · PyPI

GHSA-crhp-7c74-cg4c Improper Input Validation in mindsdb

MEDIUM Published 2023-12-12 Modified 2024-11-22 Official page ↗
Aliases
CVE-2023-49796
Ecosystem
PyPI
Packages
mindsdb
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-20
Reviewed
2023-12-12

Affected packages

• PyPI mindsdb: < 23.11.4.1 → fixed in 23.11.4.1

Description

Impact The put method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not validate the user-controlled `name` value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which leads to path injection. This issue may lead to arbitrary file write. This vulnerability allows for writing files anywhere on the server that the filesystem permissions that the running server has access to. Patches Use mindsdb staging branch or v23.11.4.1 References • GHSL-2023-184 • See CodeQL path injection prevention guidelines and OWASP guidelines.

Related

Alias · CVE (1)

  • CVE-2023-49796 MindsDB connects artificial intelligence models to real time data. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References