CVE-2023-49795 MindsDB Server-Side Request Forgery vulnerability

What is CVE-2023-49795?

CVE-2023-49795 is a medium-severity server-side request forgery vulnerability in mindsdb, published on 11 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnerability in `file.py`. This can lead to limited information disclosure. Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue.

Weakness: CWE-918

Which versions are affected by CVE-2023-49795?

3 open source packages ship an affected version, including mindsdb. It affects 1 product.

Products include Mindsdb Mindsdb.

How do I fix CVE-2023-49795?

Upgrade mindsdb to 23.11.4.1 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2023-49795 being exploited?

There is no known exploitation of CVE-2023-49795 in the wild and no public exploit code.

Other vulnerabilities in mindsdb

• CVE-2024-24759 MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding Critical 9.3
• CVE-2023-50731 MindsDB has arbitrary file write in file.py Critical 9.1
• CVE-2023-38699 MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issue Critical 9.1
• CVE-2024-45856 MindsDB Cross-site Scripting vulnerability Critical 9.0
• CVE-2026-27483 MindsDB has Path Traversal in /api/files Leading to Remote Code Execution High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-34mr-6q8x-g9r6, PYSEC-2023-277.