MindsDB Eval Injection vulnerability
An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine, the code will be passed to an eval function and executed on the server.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-45846US | high8.8 | Exploit | ||
An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specia… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/mindsdb/mindsdbPACKAGE
- https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2024-77.yamlWEB
- https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdbWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-45846ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan