GitHub Advisoryadvisory · PyPI

GHSA-crmg-rp64-5cm3 MindsDB Eval Injection vulnerability

HIGH Published 2024-09-12 Modified 2024-09-16 Official page ↗
Aliases
CVE-2024-45847
Ecosystem
PyPI
Packages
mindsdb
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94, CWE-95
Reviewed
2024-09-12

Affected packages

• PyPI mindsdb: >= 23.11.4.2, < 24.7.4.1 → fixed in 24.7.4.1

Description

An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration engine, the code will be passed to an eval function and executed on the server.

Related

Alias · CVE (1)

  • CVE-2024-45847 An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several… vulnerability

Weakness · CWE (2)

  • CWE-94 Improper Control of Generation of Code weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References