Mage AI Path Traversal vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-45190 · ADVISORY
• mage-ai/mage-ai · PACKAGE
• research.jfrog.com/vulnerabilities/mage-ai-pipeline-interaction-request-remote-arbitrary-file-leak-jfsa-2024-001039605 · WEB
• research.jfrog.com/vulnerabilities/mage-ai-pipeline-interaction-request-remote-arbitrary-file-leak-jfsa-2024-001039605 · Exploit
• pypi.org/project/mage-ai · PACKAGE
• GitHub Advisory GHSA-4mrc-w7jh-hx4j · ADVISORY

mage-ai 的其他漏洞

• CVE-2024-45189中危 6.5Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content"…
• CVE-2024-45188中危 6.5Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content…
• CVE-2024-45187高危 8.8Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specif…
• CVE-2024-8072中危 5.3Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users
• CVE-2023-31143严重 9.8mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior …