CVE-2024-45856

Description

A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI.

Reserved 2024-09-10 | Published 2024-09-12 | Updated 2024-09-12 | Assigner HiddenLayer

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
unaffected

*
affected

References

hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/

cve.org (CVE-2024-45856)

nvd.nist.gov (CVE-2024-45856)

Download JSON