In short
- CVE-2023-31143 is a CRITICAL (CVSS 9.8) vulnerability affecting mage-ai, mage-ai (mage).
- Chance of exploitation in the next 30 days (EPSS): 0.66%, higher than 51.8% of all vulnerabilities.
- Fix: update to 0.8.72 or later.
| Package | Affected versions | Patched versions |
|---|
| mage-ai PyPI | ≥ 0.8.34, < 0.8.72
| 0.8.72
|
| mage-ai | ≥ 0.8.34, < 0.8.72
| 0.8.72
|
Description
Impact
You may be impacted if you're using Mage with user authentication enabled. The terminal could be accessed by users who are not signed in or do not have editor permissions.
Patches
The vulnerability has been resolved in Mage version 0.8.72.
NVD description
mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free