CVE-2024-24759

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding. The vulnerability can also lead to denial of service. Version 23.12.4.2 contains a patch.

• CWE-918
• CWE-918

• https://github.com/mindsdb/mindsdb/commit/5f7496481bd3db1d06a2d2e62c0dce960a1fe12bPatch
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4jcv-vp96-94xrExploit, Vendor Advisory

Published

Sep 5, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-24753Bref enable serverless PHP on AWS Lambda. When Bref is used …6.5
• CVE-2024-24754Bref enable serverless PHP on AWS Lambda. When Bref is used …9.8
• CVE-2024-24755discourse-group-membership-ip-block is a discourse plugin th…5.3
• CVE-2024-24756Crafatar serves Minecraft avatars based on the skin for use …7.5
• CVE-2024-24757open-irs is an issue response robot that reponds to issues i…9.8
• CVE-2024-24758Undici is an HTTP/1.1 client, written from scratch for Node.…4.5
• CVE-2024-2476The OceanWP theme for WordPress is vulnerable to unauthorize…4.3
• CVE-2024-24760mailcow is a dockerized email package, with multiple contain…7.3
• CVE-2024-24761Galette is a membership management web application for non p…7.5
• CVE-2024-24762`python-multipart` is a streaming multipart parser for Pytho…7.5
• CVE-2024-24763JumpServer is an open source bastion host and an operation a…6.1
• CVE-2024-24764October is a self-hosted CMS platform based on the Laravel P…4.8