Medium severity · published Aug 4, 2023
CVE-2023-38699
MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Mindsdb · Mindsdb
before 23.7.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-38699
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-38699
Patch
https://github.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd97689919053b
Release Notes
https://github.com/mindsdb/mindsdb/releases/tag/v23.7.4.0
Vendor Advisory
https://github.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcw
More from Mindsdb
9.1
CVE-2025-68472
MindsDB is a platform for building artificial intelligence from enterprise data
9.1
CVE-2024-24759
MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding
9.1
CVE-2023-50731
MindsDB is a SQL Server for artificial intelligence
8.8
CVE-2026-92207
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability
8.8
CVE-2026-27483
MindsDB has Path Traversal in /api/files Leading to Remote Code Execution