PYSEC-2023-64

    Dashboard / Vulnerabilities / PYSEC-2023-64

    PYSEC-2023-64

    Published: 9 May 2023Last Modified: 8 Nov 2023

    Summary:

    Details: mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.

    References: https://github.com/mage-ai/mage-ai/commit/f63cd00f6a3be372397d37a4c9a49bfaf50d7650, https://github.com/mage-ai/mage-ai/security/advisories/GHSA-c6mm-2g84-v4m7

    Affected packages

    Package

    Name: mage-ai

    Purl: pkg:pypi/mage-ai

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -f63cd00f6a3be372397d37a4c9a49bfaf50d7650

    Affected versions

    0.8.34
    0.8.35
    0.8.36
    0.8.37
    0.8.38
    0.8.39
    0.8.40
    0.8.41
    0.8.42
    0.8.43
    0.8.44
    0.8.45
    0.8.46
    0.8.47
    0.8.48
    0.8.49
    0.8.50
    0.8.51
    0.8.52
    0.8.53
    0.8.54
    0.8.55
    0.8.56
    0.8.57
    0.8.58
    0.8.59
    0.8.60
    0.8.61
    0.8.62
    0.8.63
    0.8.64
    0.8.66
    0.8.67
    0.8.68
    0.8.69
    0.8.70
    0.8.71

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2023-64 | CVE-DB