Is CVE-2024-3575 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-3575 being exploited in the wild.

How severe is CVE-2024-3575?

Medium severity, with a CVSS score of 5.8, published 16 April 2024.

Which products and versions are affected?

mindsdb (PyPI) <= 23.6.3.1, ECOSYSTEM:introduced=0,last_affected=23.6.3.1.

Is there a fix for CVE-2024-3575?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-3575 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-3575?

Check whether you run mindsdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-3575: MindsDB stored XSS via CSV file upload

Q: Which products and versions are affected?

mindsdb (PyPI) <= 23.6.3.1, ECOSYSTEM:introduced=0,last_affected=23.6.3.1.

Q: Is there a fix for CVE-2024-3575?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2024-3575 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2024-3575?

Check whether you run mindsdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-3575 · Severity: medium · CVSS 5.8 · Published 2024-04-16

MindsDB, an open-source platform for building AI models from data, is vulnerable to a security flaw where malicious code can be hidden inside uploaded CSV files. If a user views one of these files, the hidden code can execute in their browser, potentially allowing an attacker to steal session information or perform actions on the user's behalf. This affects both the cloud-hosted and self-hosted versions of the software.

Technologies: mindsdb (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-3575 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-3575 being exploited in the wild.
How severe is CVE-2024-3575?: Medium severity, with a CVSS score of 5.8, published 16 April 2024.
Which products and versions are affected?: mindsdb (PyPI) <= 23.6.3.1, ECOSYSTEM:introduced=0,last_affected=23.6.3.1.
Is there a fix for CVE-2024-3575?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-3575 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-3575?: Check whether you run mindsdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in MindsDB due to improper neutralization of input during the processing of CSV file uploads. An attacker can upload a CSV file containing a malicious JavaScript payload; when this file is subsequently viewed within the MindsDB interface (cloud or OSS), the payload executes in the context of the victim's browser. The vulnerability is tracked as CWE-79 and affects versions up to and including 23.6.3.1. While the CVSS vector indicates no user interaction, XSS typically requires a victim to view the malicious content. No official patch version was specified in the advisory.

Affected products

MindsDB mindsdb <= 23.6.3.1

Identifiers

CVE-2024-3575
GHSA-93c5-rj2p-w52x
PYSEC-2024-288

Timeline

2024-04-16: disclosed: NVD publication date
2024-04-16: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.