Описание
Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server
Ссылки
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:mage:mage-ai:-:*:*:*:*:python:*:*
EPSS
Процентиль: 24%
0.00083
Низкий
7.1 High
CVSS3
8.8 High
CVSS3
Дефекты
CWE-613
CWE-266
Связанные уязвимости
CVSS3: 7.1
github
больше 1 года назад
Mage AI incorrectly gives privileges to users with deleted accounts
EPSS
Процентиль: 24%
0.00083
Низкий
7.1 High
CVSS3
8.8 High
CVSS3
Дефекты
CWE-613
CWE-266