CVE-2023-49795

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnerability in `file.py`. This can lead to limited information disclosure. Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Dec 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-497965.3MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in CVE-2023-497977.8PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a priv CVE-2023-497987.5OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a li CVE-2023-497997.5`nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to CVE-2023-49805.4Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0.CVE-2023-498007.5`nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. Ther CVE-2023-498017.5Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `ge CVE-2023-498026.1The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to versi CVE-2023-498037.5@koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware ope CVE-2023-498047.8Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma,CVE-2023-498058.8Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it CVE-2023-498075.4Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exp