CVE-2024-45189: Mage AI git content request remote arbitrary file leak
Published Aug 23, 2024
·Updated
Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content" request
Affected Software
2 affected components
pip/mage-ai<=0.9.73
Mage Mage-ai Python
Event History
Aug 23, 2024
CVE Published
via MITRE·07:15 PM
Data Sourced
via MITRE·07:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverity
Data Sourced
via NVD·08:15 PM
WeaknessAffected Software
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-45189?
CVE-2024-45189 is classified as a high-severity vulnerability due to its potential for file leakage.
2
How do I fix CVE-2024-45189?
To fix CVE-2024-45189, upgrade Mage AI to version 0.9.74 or later where the vulnerability has been addressed.
3
Who is affected by CVE-2024-45189?
CVE-2024-45189 affects Mage AI versions up to and including 0.9.73 when used with the Viewer role.
4
What type of vulnerability is CVE-2024-45189?
CVE-2024-45189 is a path traversal vulnerability that allows file leakage from the Mage server.
5
What should I do if I cannot upgrade to fix CVE-2024-45189?
If you cannot upgrade, consider restricting access to the Viewer role to mitigate the risk associated with CVE-2024-45189.