id: PYSEC-2024-79
modified: 2024-09-16T19:20:04.841635Z
published: 2024-09-12T13:15:00Z
aliases:
- CVE-2024-45849
- GHSA-c85f-pcx6-2ghm
details: An arbitrary code execution vulnerability exists in versions 23.10.5.0 up
  to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is
  installed on the server. For databases created with the SharePoint engine, an ‘INSERT’
  query can be used for list creation. If such a query is specially crafted to contain
  Python code and is run against the database, the code will be passed to an eval
  function and executed on the server.
affected:
- package:
    ecosystem: PyPI
    name: mindsdb
    purl: pkg:pypi/mindsdb
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 23.10.5.0
    - fixed: 24.7.4.1
  versions:
  - 23.10.5.0
  - 23.11.1.0
  - 23.11.4.0
  - 23.11.4.1
  - 23.11.4.4a6
  - 23.12.4.0
  - 23.12.4.1
  - 23.12.4.2
  - 24.1.4.0
  - 24.2.3.0
  - 24.3.4.0
  - 24.3.4.1
  - 24.3.4.2
  - 24.3.5.0
  - 24.4.2.0
  - 24.4.2.1
  - 24.4.3.0
  - 24.5.4.0
  - 24.6.1.0
  - 24.6.1.1
  - 24.6.2.0
  - 24.6.2.2
  - 24.6.3.0
  - 24.6.3.1
  - 24.6.4.1
  - 24.7.1.0
  - 24.7.2.0
  - 24.7.3.0
  - 24.7.4.0
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
references:
- type: EVIDENCE
  url: https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
- type: ADVISORY
  url: https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
- type: ADVISORY
  url: https://github.com/advisories/GHSA-c85f-pcx6-2ghm