HighVulnerability
CVE-2024-45852: MindsDB deserialization flaw allows code execution via model
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2024-45852
- Published
- Record updated
- Affected
- mindsdb >= 23.3.2.0, <= 24.9.2.1
- Fixed in
- No fixed version was stated when the source was last read.
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.7%
Summary
CVE-2024-45852 is a deserialization of untrusted data flaw (CWE-502) in versions 23.3.2.0 and newer of the MindsDB platform. A maliciously uploaded model can run arbitrary code on the server when it is interacted with. HiddenLayer published the advisory, and NVD has not yet provided an assessment.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- InfoSecuring next-generation edge intelligence: A survey from federated learning to autonomous agents in cyber-physical systemsSimilar attack · OpenAlex (peer-reviewed AI security)
- InfoPop Goes the Verifier: Phoneme-Targeted Data Poisoning of Voice Liveness DetectionSimilar attack · Arxiv (cs.RO + cs.CV security)
- InfoCharacterizing Recoverable Expert-Utilization Signatures in Fine-Tuned Mixture-of-Experts LLMsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- InfoDiscrete Unintentional Adversarial Perturbation Detection for DQN Traffic Signal ControlSimilar attack · OpenAlex (peer-reviewed AI security)
- InfoTrustworthy Distributed Machine Learning in Cloud-Edge-IoT Systems: A Heterogeneity-Aware Survey of Security, Privacy, and RobustnessSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)