CVE-2024-45853 HIGH

CVE-2024-45853

Vendor Mindsdb

Product mindsdb

Weakness CWE-502 · Unsafe deserialization

Published September 12, 2024

Last update September 12, 2024

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction.

Key dates

02Disclosure timeline

September 12, 2024 CVE published

September 12, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-45853

Related vulnerabilities

04Related CVE

CVE-2026-32511 WordPress Stål theme < 1.7 - Arbitrary Object Instantiation vulnerability CVE-2024-37052 CVE-2025-32647 WordPress Question Answer plugin <= 1.2.73 - PHP Object Injection vulnerability CVE-2021-3035 Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution CVE-2026-27096 WordPress ColorFolio - Freelance Designer WordPress Theme theme <= 1.3 - Deserialization of untrusted data vulnerability