CVE-2023-31143
Medium
Description
mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.
SeverityMedium
CVSS5.9
Exploit probability—
ProductMage-ai
PublishedMay 9, 2023
First seenMay 9, 2023
Weakness typeCWE-306Missing authentication for critical function
How to fix
Update
- mage mage-ai0.8.72 or later
- mage-ai0.8.72 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mage mage-ai | 0.8.34 ≤ v < 0.8.72 | 0.8.72 |
| mage-aiPyPI | 0.8.34 ≤ v < 0.8.72 | 0.8.72 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.