Search for vulnerabilities
| Vulnerability ID | VCID-kttw-x13y-b3fj |
| Aliases |
CVE-2024-45851
PYSEC-2024-81 |
| Summary | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for list item creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server. |
| Status | Published |
| Exploitability | None |
| Weighted Severity | None |
| Risk | None |
| Affected and Fixed Packages | Package Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 8.8 | https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/ |
| Reference id | Reference type | URL |
|---|---|---|
| https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/ |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
No EPSS data available for this vulnerability.
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2026-06-02T04:21:49.168858+00:00 | Pypa Importer | Import | https://github.com/pypa/advisory-database/blob/main/vulns/mindsdb/PYSEC-2024-81.yaml | 38.6.0 |