CVE-2023-49796

MEDIUM5.3EPSS 0.87%

Improper Input Validation in mindsdb

發布日:2023/12/12修改日:2026/4/23

描述

MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in `file.py` Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue.

受影響套件(2)

PyPI/mindsdbfrom 0, < 23.11.4.1
PyPI/mindsdbfrom 0, < 8d13c9c28ebcf3b36509eb679378004d4648d8fe | from 0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-49796
PATCHhttps://github.com/mindsdb/mindsdb
WEBhttps://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125
WEBhttps://github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fe
WEBhttps://github.com/mindsdb/mindsdb/security/advisories/GHSA-crhp-7c74-cg4c
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-278.yaml