Threat Investigation
Request a demo

CVE-2024-24759

Critical

Description

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding. The vulnerability can also lead to denial of service. Version 23.12.4.2 contains a patch.

SeverityCritical
CVSS9.3
Exploit probability—
ProductMindsdb
PublishedSep 5, 2024
First seenSep 5, 2024
Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update
  • mindsdb mindsdb23.12.4.2 or later
  • mindsdb23.12.4.2 or later

Affected products

ProductAffected versionsFixed in
mindsdb mindsdbv < 23.12.4.223.12.4.2
mindsdbPyPIv < 23.12.4.223.12.4.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.