Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: Mage Component: Mage-ai Clear all filters
TI-2024-30287 CVE-2024-45190 · GHSA-4mrc-w7jh-hx4j

Mage AI pipeline interaction request remote arbitrary file leak

Priority MEDIUM 62

Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Pipeline Interaction" request

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00859 Published 2024-08-23 No fix listed CWE-35
TI-2024-30286 CVE-2024-45189 · GHSA-cgxv-795x-3vqr

Mage AI git content request remote arbitrary file leak

Priority LOW 31

Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content" request

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00881 Published 2024-08-23 No fix listed CWE-22
TI-2024-30285 CVE-2024-45188 · GHSA-v9wr-8wrm-h6p7

Mage AI file content request remote arbitrary file leak

Priority MEDIUM 62

Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content" request

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00881 Published 2024-08-23 No fix listed CWE-22
TI-2024-30284 CVE-2024-45187 · GHSA-jg95-r9xh-xw9c

Mage AI allows deleted users to use the terminal server with admin access, leading to remote code execution

Priority MEDIUM 41

Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI termi…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00495 Published 2024-08-23 No fix listed CWE-613