Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-8072 · ADVISORY
• mage-ai/mage-ai · PACKAGE
• research.jfrog.com/vulnerabilities/mage-ai-terminal-server-infoleak-jfsa-2024-001039574 · WEB
• research.jfrog.com/vulnerabilities/mage-ai-terminal-server-infoleak-jfsa-2024-001039574 · Exploit
• pypi.org/project/mage-ai · PACKAGE
• GitHub Advisory GHSA-cgrq-wvfj-v28j · ADVISORY

More vulnerabilities in mage-ai

• CVE-2024-45190MEDIUM 6.5Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Pipeline Int…
• CVE-2024-45189MEDIUM 6.5Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content"…
• CVE-2024-45188MEDIUM 6.5Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content…
• CVE-2024-45187HIGH 8.8Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specif…
• CVE-2023-31143CRITICAL 9.8mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior …