CVE-2023-31143: Mage terminal user authentication not working properly
Impact
You may be impacted if you're using Mage with user authentication enabled. The terminal could be accessed by users who are not signed in or do not have editor permissions.
Patches
The vulnerability has been resolved in Mage version 0.8.72.
Other sources
mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-31143?
CVE-2023-31143 has been classified as a significant vulnerability affecting user authentication in Mage.
How do I fix CVE-2023-31143?
To fix CVE-2023-31143, update Mage to version 0.8.72 or later.
Who is affected by CVE-2023-31143?
Users of Mage with user authentication enabled are affected by CVE-2023-31143.
What are the potential risks of CVE-2023-31143?
The risk of CVE-2023-31143 includes unauthorized access to terminal functions by non-signed users.
When was CVE-2023-31143 discovered?
CVE-2023-31143 was disclosed as part of an advisory related to Mage software vulnerabilities.