Em resumo
- CVE-2023-31143 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta mage-ai, mage-ai (mage).
- Chance de exploração nos próximos 30 dias (EPSS): 0.66%, maior que 51.8% das vulnerabilidades.
- Correção: atualize para 0.8.72 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| mage-ai PyPI | ≥ 0.8.34, < 0.8.72
| 0.8.72
|
| mage-ai | ≥ 0.8.34, < 0.8.72
| 0.8.72
|
Description
Impact
You may be impacted if you're using Mage with user authentication enabled. The terminal could be accessed by users who are not signed in or do not have editor permissions.
Patches
The vulnerability has been resolved in Mage version 0.8.72.
NVD description
mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free