Home » Database

AVID-2026-R1298

Description

MindsDB Server-Side Request Forgery vulnerability (CVE-2023-49795)

Details

MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnerability in file.py. This can lead to limited information disclosure. Users should use MindsDB’s staging branch or v23.11.4.1, which contain a fix for the issue.

Reason for inclusion in AVID: CVE-2023-49795 is a server-side request forgery vulnerability in MindsDB server (AI data/model integration platform) prior to 23.11.4.1. This is a software vulnerability affecting an AI-related server component used in AI pipelines to connect models to real-time data. It concerns the AI software stack (deployment/runtime) rather than hardware/firmware. It has clear CVE signaling, impact (information disclosure), and a fixed version, making it relevant to the software supply chain for general-purpose AI systems.

References

Affected or Relevant Artifacts

  • Developer: mindsdb
  • Deployer: mindsdb
  • Artifact Details:
TypeName
Systemmindsdb

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Base Score6.5
Base Severity🟠 Medium
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality Impact🟢 Low
Integrity Impact🟢 Low
Availability ImpactNONE

CWE

IDDescription
CWE-918CWE-918: Server-Side Request Forgery (SSRF)

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2023-12-11
  • Version: 0.3.3
  • AVID Entry