{"id":"CVE-2023-49796","published":"2023-12-11T20:38:25Z","modified":"2024-08-02T22:01:26Z","title":"MindsDB Arbitrary File Write vulnerability","vendor":"mindsdb","product":"mindsdb","tier":"tail","description":{"text":"MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in `file.py` Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00492,"percentile":0.42234,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://github.com/mindsdb/mindsdb/security/advisories/GHSA-crhp-7c74-cg4c","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fe","tags":["x_refsource_MISC"]}],"priority":{"score":12.2,"factors":[{"name":"EPSS percentile","points":8.45},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"mindsdb","affectedVersions":[{"vendor":"mindsdb","product":"mindsdb","versions":["< 23.11.4.1"]}],"affected":[{"ecosystem":"PyPI","package":"mindsdb","vulnerableRanges":["<23.11.4.1"],"patched":["23.11.4.1"],"from":["GHSA-crhp-7c74-cg4c"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0151","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-mindsdb-cve-2023-30620","parents":[{"from":"CVE-2023-30620","to":"CVE-2023-49796","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:mindsdb","fromFixed":"23.2.1.0","toFixed":"23.11.4.1","daysApart":234},{"kind":"same-code","provenance":"machine","files":["mindsdb/api/http/namespaces/file.py"],"commits":["https://github.com/mindsdb/mindsdb/commit/4419b0f0019c000db390b54d8b9d06e1d3670039","https://github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fe"],"basis":"shared function","functions":["on_file"]}]}],"children":[{"from":"CVE-2023-49796","to":"CVE-2024-24759","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["mindsdb/integrations/handlers/llama_index_handler/llama_index_handler.py"],"commits":["https://github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fe","https://github.com/mindsdb/mindsdb/commit/5f7496481bd3db1d06a2d2e62c0dce960a1fe12b"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2022-23522","published":"2023-03-30","fixed":"22.11.4.3","kev":false},{"cve":"CVE-2023-30620","published":"2023-04-21","fixed":"23.2.1.0","kev":false},{"cve":"CVE-2023-49795","published":"2023-12-11","fixed":"23.11.4.1","kev":false},{"cve":"CVE-2023-49796","published":"2023-12-11","fixed":"23.11.4.1","kev":false},{"cve":"CVE-2023-50731","published":"2023-12-22","fixed":"23.11.4.1","kev":false},{"cve":"CVE-2024-24759","published":"2024-09-05","fixed":"23.12.4.2","kev":false},{"cve":"CVE-2024-45846","published":"2024-09-12","fixed":"24.7.4.1","kev":false}],"package":"PyPI:mindsdb"}}