medium5.3
CVE-2024-8072
Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users
Impact
Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | mage-ai | <= 0.9.73 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mage | Mage-Ai | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://research.jfrog.com/vulnerabilities/mage-ai-terminal-server-infoleak-jfsa-2024-001039574/
- https://github.com/advisories/GHSA-cgrq-wvfj-v28j
- https://nvd.nist.gov/vuln/detail/CVE-2024-8072
- https://research.jfrog.com/vulnerabilities/mage-ai-terminal-server-infoleak-jfsa-2024-001039574