CVE-2023-49795

MEDIUM

MindsDB < 23.11.4.1 - Server-Side Request Forgery in file.py

Title source: llm
STIX 2.1

Description

MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnerability in `file.py`. This can lead to limited information disclosure. Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue.

References (2)

Core 2

Scores

CVSS v3 6.5
EPSS 0.0042
EPSS Percentile 33.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Details

CWE
CWE-918
Status published
Products (2)
mindsdb/mindsdb < 23.11.4.1
pypi/mindsdb 0 - 23.11.4.1PyPI
Published Dec 11, 2023
Tracked Since Feb 18, 2026