CVE-2024-45847

Published: 2024-09-12T13:15Z

Last Modified: 2024-09-16T17:31Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration engine, the code will be passed to an eval function and executed on the server. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt