GitHub Advisoryadvisory · PyPI

GHSA-jg95-r9xh-xw9c Mage AI incorrectly gives privileges to users with deleted accounts

MEDIUM Published 2024-08-23 Modified 2025-10-13 Official page ↗
Aliases
CVE-2024-45187
Ecosystem
PyPI
Packages
mage-ai
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-266, CWE-613
Reviewed
2024-08-23

Affected packages

• PyPI mage-ai: <= 0.9.73 (no fix yet)

Description

Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2024-45187 Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and… vulnerability

Weakness · CWE (1)

  • CWE-266 Incorrect Privilege Assignment weakness

References