Skip to main content

Mage Ai CVE-2024-45187

HIGH
Insufficient Session Expiration (CWE-613)
2024-08-23 reefs@jfrog.com
RCE Mage Ai
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Aug 23, 2024 - 19:15 nvd
HIGH 8.8

DescriptionNVD

Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server

AnalysisAI

Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-613. Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server Affected products include: Mage Mage-Ai.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Mage Ai

View all
CVE-2024-45190 MEDIUM POC
6.5 Aug 23

Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal

CVE-2024-45189 MEDIUM POC
6.5 Aug 23

Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal

CVE-2024-45188 MEDIUM POC
6.5 Aug 23

Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal

CVE-2023-31143 CRITICAL
9.8 May 09

mage-ai is an open-source data pipeline tool for transforming and integrating data. Rated critical severity (CVSS 9.8),

CVE-2024-8072 MEDIUM POC
5.3 Aug 22

Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users. Rated me

Same weakness CWE-613 – Insufficient Session Expiration

View all
CVE-2022-36179 CRITICAL POC
9.8
CVE-2026-26342 CRITICAL POC
9.8
CVE-2016-5069 CRITICAL POC
9.8
CVE-2024-29401 CRITICAL POC
9.8
CVE-2023-49091 CRITICAL POC
9.8
CVE-2023-5865 CRITICAL POC
9.8
CVE-2023-5838 CRITICAL POC
9.8
CVE-2023-1854 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2024-45187 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy