CVE-2024-45847
- State
- Published
- Severity
- 8.8 High
- Published
- Sep 12, 2024
- Updated
- Sep 12, 2024
- Reserved
- Sep 10, 2024
Description
An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration engine, the code will be passed to an eval function and executed on the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | HiddenLayer |
Weaknesses
- CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Affected Products
| Product | Versions |
|---|---|
mindsdbmindsdb |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.