CVE-2024-45188: Mage AI file content request remote arbitrary file leak
Published Aug 23, 2024
·Updated
Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content" request
Affected Software
2 affected components
pip/mage-ai<=0.9.73
Mage Mage-ai Python
Event History
Aug 23, 2024
CVE Published
via MITRE·07:14 PM
Data Sourced
via MITRE·07:14 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverity
Data Sourced
via NVD·08:15 PM
WeaknessAffected Software
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-45188?
CVE-2024-45188 is considered a high-severity vulnerability due to its potential for unauthorized file disclosure.
2
How do I fix CVE-2024-45188?
To fix CVE-2024-45188, upgrade the Mage AI package to version 0.9.74 or later, which addresses the path traversal issue.
3
Who is affected by CVE-2024-45188?
Any user with the "Viewer" role in Mage AI on version 0.9.73 or earlier is affected by CVE-2024-45188.
4
What is the impact of CVE-2024-45188?
The impact of CVE-2024-45188 allows remote users to potentially leak sensitive files from the server.
5
What is the nature of the vulnerability in CVE-2024-45188?
CVE-2024-45188 involves a path traversal vulnerability in the "File Content" request, enabling unauthorized file access.