CVE-2023-49795

MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnerability in `file.py`. This can lead to limited information disclosure. Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue.

• CWE-918

• https://github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fePatch
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-34mr-6q8x-g9r6Vendor Advisory
• https://github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fePatch
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-34mr-6q8x-g9r6Vendor Advisory

Published

Dec 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4979Cross-site Scripting (XSS) - Reflected in GitHub repository …5.4
• CVE-2023-49790The Nextcloud iOS Files app allows users of iOS to interact …4.3
• CVE-2023-49791Nextcloud Server provides data storage for Nextcloud, an ope…5.4
• CVE-2023-49792Nextcloud Server provides data storage for Nextcloud, an ope…9.8
• CVE-2023-49793CodeChecker is an analyzer tooling, defect database and view…6.5
• CVE-2023-49794KernelSU is a Kernel-based root solution for Android devices…7.8
• CVE-2023-49796MindsDB connects artificial intelligence models to real time…5.3
• CVE-2023-49797PyInstaller bundles a Python application and all its depende…7.8
• CVE-2023-49798OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2023-49799`nuxt-api-party` is an open source module to proxy API reque…7.5
• CVE-2023-4980Cross-site Scripting (XSS) - Generic in GitHub repository li…5.4
• CVE-2023-49800`nuxt-api-party` is an open source module to proxy API reque…7.5