CVE-2023-38699

Katalog CVE

CVSS 6.5 · Medium EPSS 0,30%

Kerentanan Missing Encryption of Sensitive Data pada mindsdb. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.

Rincian

Terbit di NVD

4 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-311: Missing Encryption of Sensitive Data

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcw advisory vendor
• https://github.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd97689919053b patch
• https://github.com/mindsdb/mindsdb/releases/tag/v23.7.4.0 release notes