GHSA-c6mm-2g84-v4m7

Mage-ai missing user authentication

Source: GitHub Advisory Database (reviewed) High CVE-2023-31143

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	mage-ai	>= 0.8.34, < 0.8.72	0.8.72

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact You may be impacted if you're using Mage with user authentication enabled. The terminal could be accessed by users who are not signed in or do not have editor permissions. ### Patches The vulnerability has been resolved in Mage version 0.8.72.

References

External links from the advisory. They lead to third-party sites.

https://github.com/mage-ai/mage-ai/security/advisories/GHSA-c6mm-2g84-v4m7 web
https://nvd.nist.gov/vuln/detail/CVE-2023-31143 advisory
https://github.com/mage-ai/mage-ai/commit/f63cd00f6a3be372397d37a4c9a49bfaf50d7650 web
https://github.com/mage-ai/mage-ai package
https://github.com/pypa/advisory-database/tree/main/vulns/mage-ai/PYSEC-2023-64.yaml web