PT-2023-36076 · Mindsdb · Mindsdb

Published 2023-12-11 · Updated 2023-12-11

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MindsDB versions prior to 23.11.4.1

Description The issue concerns a limited file write vulnerability in the file.py module. This vulnerability allows for certain unauthorized file system modifications.

Recommendations For versions prior to 23.11.4.1, update to version 23.11.4.1 or use MindsDB's staging branch, which contains a fix for the issue.

Fix

Related Identifiers

PYSEC-2023-278

Affected Products

Mindsdb

References · 3

• https://osv.dev/vulnerability/PYSEC-2023-278 · Vendor Advisory
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-crhp-7c74-cg4c · Note
• https://github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fe · Note