high5.9
CVE-2023-31143
Mage-ai missing user authentication
Impact
### Impact You may be impacted if you're using Mage with user authentication enabled. The terminal could be accessed by users who are not signed in or do not have editor permissions. ### Patches The vulnerability has been resolved in Mage version 0.8.72.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | mage-ai | >= 0.8.34, < 0.8.72 | 0.8.72 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mage | Mage-Ai | from 0.8.34 before 0.8.72 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/mage-ai/mage-ai/commit/f63cd00f6a3be372397d37a4c9a49bfaf50d7650
- https://github.com/mage-ai/mage-ai/security/advisories/GHSA-c6mm-2g84-v4m7
- https://github.com/advisories/GHSA-c6mm-2g84-v4m7
- https://nvd.nist.gov/vuln/detail/CVE-2023-31143
- https://github.com/pypa/advisory-database/tree/main/vulns/mage-ai/PYSEC-2023-64.yaml