CVE-2024-3575: Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb
Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb
Other sources
When a user uploads a csv file that contains an javascript payload a Cross-site Scripting (XSS) is triggered when the file is viewed. This is true for both cloud version and OSS version.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3575?
CVE-2024-3575 is classified as a medium severity vulnerability due to its potential for exploitation through Cross-site Scripting (XSS).
How do I fix CVE-2024-3575?
To fix CVE-2024-3575, ensure that user-uploaded CSV files are properly sanitized and validated before displaying their contents.
What software versions are affected by CVE-2024-3575?
CVE-2024-3575 affects all versions of mindsdb up to and including 23.6.3.1.
What is the consequence of the CVE-2024-3575 vulnerability?
The consequence of CVE-2024-3575 is that it enables an attacker to execute arbitrary JavaScript in a user's browser, potentially leading to data theft or session hijacking.
Is CVE-2024-3575 present in both cloud and OSS versions of mindsdb?
Yes, CVE-2024-3575 is present in both the cloud and open-source (OSS) versions of mindsdb.