PT-2024-31469 · Unknown · Mage Ai Framework

Ori Hollander · Published 2024-08-23 · Updated 2026-01-13 · CVE-2024-45187

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mage AI framework (affected versions not specified)

Description The issue concerns guest users in the Mage AI framework who remain logged in after their accounts are deleted. These users are mistakenly given high privileges, specifically access to remotely execute arbitrary code through the Mage AI terminal server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Privilege Assignment

Insufficient Session Expiration

Weakness Enumeration

CWE-266

CWE-613

Related Identifiers

CVE-2024-45187

GHSA-JG95-R9XH-XW9C

Affected Products

Mage Ai Framework

References · 12

• https://osv.dev/vulnerability/GHSA-jg95-r9xh-xw9c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45187 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45187 · Vendor Advisory
• https://github.com/mage-ai/mage-ai · Note
• https://twitter.com/dailycve/status/2011215886901031020 · Twitter Post
• https://t.me/cvedetector/4037 · Telegram Post
• https://twitter.com/cracbot/status/1828673977243349151 · Twitter Post
• https://twitter.com/CVEnew/status/1827061416546726173 · Twitter Post
• https://t.me/cveNotify/138248 · Telegram Post
• https://research.jfrog.com/vulnerabilities/mage-ai-deleted-users-rce-jfsa-2024-001039602 · Note
• https://twitter.com/transilienceai/status/1859099663279808935 · Twitter Post
• https://twitter.com/transilienceai/status/1860187716803265023 · Twitter Post