En resumen
- CVE-2023-31143 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a mage-ai, mage-ai (mage).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.66%, mayor que el 51.8% de las vulnerabilidades.
- Solución: actualizar a 0.8.72 o posterior.
| Package | Affected versions | Patched versions |
|---|
| mage-ai PyPI | ≥ 0.8.34, < 0.8.72
| 0.8.72
|
| mage-ai | ≥ 0.8.34, < 0.8.72
| 0.8.72
|
Description
Impact
You may be impacted if you're using Mage with user authentication enabled. The terminal could be accessed by users who are not signed in or do not have editor permissions.
Patches
The vulnerability has been resolved in Mage version 0.8.72.
NVD description
mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free