CVE-2023-49796

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in `file.py` Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
mindsdb	mindsdb	< 23.11.4.1

References

Timeline

Published: Dec 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-497977.8PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a priv CVE-2023-497987.5OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a li CVE-2023-497997.5`nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to CVE-2023-49805.4Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0.CVE-2023-498007.5`nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. Ther CVE-2023-498017.5Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `ge CVE-2023-498026.1The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to versi CVE-2023-498037.5@koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware ope CVE-2023-498047.8Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma,CVE-2023-498058.8Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it CVE-2023-498075.4Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exp CVE-2023-498096.5Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to th