What is GHSA-c6mm-2g84-v4m7?

GHSA-c6mm-2g84-v4m7 is a security advisory published by GitHub Security Advisories with High severity. Mage-ai missing user authentication

Which CVE IDs does GHSA-c6mm-2g84-v4m7 cover?

GHSA-c6mm-2g84-v4m7 covers the following CVE IDs: CVE-2023-31143. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c6mm-2g84-v4m7?

GHSA-c6mm-2g84-v4m7 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-c6mm-2g84-v4m7?

GHSA-c6mm-2g84-v4m7 affects 1 product, including: pip/mage-ai:\u003e= 0.8.34, \u003c 0.8.72.

GHSA-c6mm-2g84-v4m7HighCVSS 5.9

Mage-ai missing user authentication

Vendor

GitHub Security Advisories

Published

May 5, 2023

Last Modified

September 30, 2024

🔗 CVE IDs covered (1)

CVE-2023-31143 →

📋 Description

Impact

You may be impacted if you're using Mage with user authentication enabled. The terminal could be accessed by users who are not signed in or do not have editor permissions.

Patches

The vulnerability has been resolved in Mage version 0.8.72.

🎯 Affected products1

pip/mage-ai:>= 0.8.34, < 0.8.72

🔗 References (5)

https://github.com/mage-ai/mage-ai/security/advisories/GHSA-c6mm-2g84-v4m7
https://nvd.nist.gov/vuln/detail/CVE-2023-31143
https://github.com/mage-ai/mage-ai/commit/f63cd00f6a3be372397d37a4c9a49bfaf50d7650
https://github.com/pypa/advisory-database/tree/main/vulns/mage-ai/PYSEC-2023-64.yaml
https://github.com/advisories/GHSA-c6mm-2g84-v4m7