CVE-2024-45850: Code Injection
An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for site column creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45850?
CVE-2024-45850 is classified with a high severity due to its potential for arbitrary code execution.
How do I fix CVE-2024-45850?
To mitigate CVE-2024-45850, upgrade the MindsDB platform to version 24.7.4.2 or later.
What versions are affected by CVE-2024-45850?
CVE-2024-45850 affects MindsDB versions from 23.10.5.0 up to 24.7.4.1.
What type of vulnerability is CVE-2024-45850?
CVE-2024-45850 is an arbitrary code execution vulnerability involving the MindsDB platform with Microsoft SharePoint integration.
Can CVE-2024-45850 be exploited remotely?
Yes, CVE-2024-45850 can be exploited remotely if the vulnerable MindsDB instance is exposed to untrusted networks.