CVE-2024-45854: High severity mindsdb vulnerability
Published Sep 12, 2024
·Updated
Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describe’ query is run on it.
Affected Software
2 affected components
pip/mindsdb>=23.10.3.0<=24.9.2.1
MindsDB MindsDB>=23.10.3.0
Event History
Sep 12, 2024
CVE Published
via MITRE·01:03 PM
Data Sourced
via MITRE·01:03 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·03:33 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-45854?
CVE-2024-45854 is considered a critical vulnerability due to its potential to allow arbitrary code execution on the server.
2
How do I fix CVE-2024-45854?
To mitigate CVE-2024-45854, upgrade MindsDB to a version later than 24.9.2.1.
3
What versions are affected by CVE-2024-45854?
CVE-2024-45854 affects MindsDB versions starting from 23.10.3.0 up to 24.9.2.1.
4
What type of vulnerability is CVE-2024-45854?
CVE-2024-45854 is a deserialization vulnerability that allows untrusted data to execute code on the server.
5
What causes CVE-2024-45854?
CVE-2024-45854 is caused by the mishandling of deserialization in the MindsDB platform, allowing malicious models to run when queried.