{"action":"Upgrade mindsdb to 23.12.4.2 or later.","affected":[{"fixed":"23.12.4.2","introduced":"0"}],"component":"mindsdb","cve_ids":["CVE-2024-24759"],"ecosystem":"PyPI","epss":0.04936,"exploited":false,"fixed_versions":["23.12.4.2"],"ghsa_id":"GHSA-4jcv-vp96-94xr","id":"tcs_01M5KGNDXF9P9V6K5B7SXQTZD2","modified_at":"2024-09-06T15:42:13.120456Z","published_at":"2024-09-05T17:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-74","https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4jcv-vp96-94xr","https://github.com/mindsdb/mindsdb/commit/5f7496481bd3db1d06a2d2e62c0dce960a1fe12b"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"PYSEC-2024-74","url":"https://osv.dev/vulnerability/PYSEC-2024-74"}],"summary":"MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website w"}