CVE-2024-45856

Advisory

A cross-site scripting (XSS) vulnerability affects all versions of the MindsDB platform. Attackers can exploit this flaw by creating ML Engines, databases, projects, or datasets with names or values containing malicious JavaScript code. When other users browse these items in the web UI, the platform inadvertently executes the embedded JavaScript, potentially compromising user accounts or sensitive data. This vulnerability allows attackers to perform various malicious actions, including stealing session tokens, hijacking user sessions, or manipulating the UI to trick users into divulging confidential information.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-32fj-r8qw-r8w8
• https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45856