Lucene search

K
cveGitHub_MCVE-2023-30620
HistoryApr 21, 2023 - 9:15 p.m.

CVE-2023-30620

2023-04-2121:15:08
CWE-22
GitHub_M
web.nvd.nist.gov
33
mindsdb
machine learning
ai
extraction vulnerability
file overwrite
cve-2023-30620
security vulnerability
upgrade recommendation

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

50.6%

mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using tarfile.extractall() from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant. An attacker may leverage this vulnerability to overwrite any local file which the server process has access to. There is no risk of file exposure with this vulnerability. This issue has been addressed in release 23.2.1.0 . Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected configurations

Nvd
Vulners
Node
mindsdbmindsdbRange23.1.5.0
VendorProductVersionCPE
mindsdbmindsdb*cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "vendor": "mindsdb",
    "product": "mindsdb",
    "versions": [
      {
        "version": "< 23.2.1.0 ",
        "status": "affected"
      }
    ]
  }
]

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

50.6%

Related for CVE-2023-30620