What is GHSA-crmg-rp64-5cm3?

GHSA-crmg-rp64-5cm3 is a security advisory published by GitHub Security Advisories with High severity. MindsDB Eval Injection vulnerability

Which CVE IDs does GHSA-crmg-rp64-5cm3 cover?

GHSA-crmg-rp64-5cm3 covers the following CVE IDs: CVE-2024-45847. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-crmg-rp64-5cm3?

GHSA-crmg-rp64-5cm3 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-crmg-rp64-5cm3?

GHSA-crmg-rp64-5cm3 affects 1 product, including: pip/mindsdb:\u003e= 23.11.4.2, \u003c 24.7.4.1.

GHSA-crmg-rp64-5cm3HighCVSS 8.8

MindsDB Eval Injection vulnerability

Vendor

GitHub Security Advisories

Published

September 12, 2024

Last Modified

September 16, 2024

🔗 CVE IDs covered (1)

CVE-2024-45847 →

📋 Description

An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration engine, the code will be passed to an eval function and executed on the server.

🎯 Affected products1

pip/mindsdb:>= 23.11.4.2, < 24.7.4.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-45847
https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb
https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80
https://github.com/advisories/GHSA-crmg-rp64-5cm3