CVE-2024-45187: Mage AI allows deleted users to use the terminal server with admin access, leading to remote code execution
Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45187?
CVE-2024-45187 has been classified as a critical severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-45187?
To fix CVE-2024-45187, upgrade the Mage AI framework to a version later than 0.9.73.
What type of attack does CVE-2024-45187 enable?
CVE-2024-45187 allows unauthorized remote code execution by guest users who should no longer have access.
Who is affected by CVE-2024-45187?
Users who utilize the Mage AI framework version up to 0.9.73 with guest accounts that remain logged in after deletion are affected by CVE-2024-45187.
What are the implications of CVE-2024-45187?
The implications of CVE-2024-45187 include potential unauthorized control of systems and access to sensitive data.