CVE-2023-38699
Mindsdb ≤ 23.7.4.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-38699 is a critical-severity Missing Encryption of Sensitive Data (CWE-311) vulnerability in Mindsdb Mindsdb. Its CVSS base score is 9.1 (Critical).
Operationally, ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Other AI Platforms.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-0146
Vulnerability Data
MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests…
more
library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Other AI Platforms
- Risk Domain
- N/A
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai, ai, ml
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Privacy and security training stresses encryption of sensitive data, reducing missing encryption weaknesses.
Exchange agreements must document security requirements, which would include encryption to protect sensitive data in transit.
The map highlights data actions that involve sensitive data, enabling identification of missing encryption requirements.
Settings can require encryption of sensitive data, preventing missing encryption weaknesses.
Architectures must describe confidentiality protections, which includes mandating encryption for sensitive data in transit and at rest.
Privacy and security curricula stress encryption requirements, reducing missing encryption of sensitive data.
Requires encryption and similar controls for CUI processed or stored externally, preventing missing encryption of sensitive data.
Monitoring detects missing encryption of sensitive data in storage or transit configurations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicit rules requiring encryption for sensitive information in transit eliminate the weakness of sending data without cryptographic protection.
created from the owner's anchor; an owner grade is a row and does not wait for an instrument (Mythos 2026-09-29T15:58Z).
Explicitly calling for protection of data in transit and at rest, plus secure encryption of communications, drives the implementation of encryption that prevents clear-text exposure of sensitive information.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-311, a class-level weakness. Rules are authored against its narrower children: CWE-312.