PT-2023-23176 · Mage Ai · Mage Ai

Kentaro Ishii · Publicado 2023-05-05 · Atualizado 2023-05-16 · CVE-2023-31143

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions mage-ai versions 0.8.34 through 0.8.71

Description The issue affects mage-ai, an open-source data pipeline tool, when used with user authentication enabled. It allows the terminal to be accessed by users who are not signed in or do not have editor permissions.

Recommendations For versions 0.8.34 through 0.8.71, update to version 0.8.72 to resolve the issue. As a temporary workaround, consider disabling user authentication until the update can be applied. Restrict access to the terminal to minimize the risk of exploitation.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2023-31143

GHSA-C6MM-2G84-V4M7

PYSEC-2023-64

Produtos afetados

Mage Ai

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31143.json · Exploit
• https://github.com/mage-ai/mage-ai/commit/f63cd00f6a3be372397d37a4c9a49bfaf50d7650 · Correção
• https://github.com/mage-ai/mage-ai/security/advisories/GHSA-c6mm-2g84-v4m7 · Aviso do Fabricante
• https://github.com/mage-ai/mage-ai · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/mage-ai/PYSEC-2023-64.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-31143 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2023-64 · Aviso do Fabricante
• https://t.me/cvenotify/50042 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-c6mm-2g84-v4m7 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-31143 · Aviso do Fabricante
• https://t.me/cibsecurity/63620 · Publicação no Telegram