Mage AI Path Traversal vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-45190 · ADVISORY
• mage-ai/mage-ai · PACKAGE
• research.jfrog.com/vulnerabilities/mage-ai-pipeline-interaction-request-remote-arbitrary-file-leak-jfsa-2024-001039605 · WEB
• research.jfrog.com/vulnerabilities/mage-ai-pipeline-interaction-request-remote-arbitrary-file-leak-jfsa-2024-001039605 · Exploit
• pypi.org/project/mage-ai · PACKAGE
• GitHub Advisory GHSA-4mrc-w7jh-hx4j · ADVISORY

mage-ai의 다른 취약점

• CVE-2024-45189보통 6.5Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content"…
• CVE-2024-45188보통 6.5Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content…
• CVE-2024-45187높음 8.8Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specif…
• CVE-2024-8072보통 5.3Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users
• CVE-2023-31143심각 9.8mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior …