GitHub Advisoryadvisory · PyPI

GHSA-c6mm-2g84-v4m7 Mage-ai missing user authentication

HIGH Published 2023-05-05 Modified 2024-09-30 Official page ↗
Aliases
CVE-2023-31143
Ecosystem
PyPI
Packages
mage-ai
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-306
Reviewed
2023-05-05

Affected packages

• PyPI mage-ai: >= 0.8.34, < 0.8.72 → fixed in 0.8.72

Description

Impact You may be impacted if you're using Mage with user authentication enabled. The terminal could be accessed by users who are not signed in or do not have editor permissions. Patches The vulnerability has been resolved in Mage version 0.8.72.

Related

Alias · CVE (1)

  • CVE-2023-31143 mage-ai is an open-source data pipeline tool for transforming and integrating data. vulnerability

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References