CVE-2024-45190: Mage AI pipeline interaction request remote arbitrary file leak
Published Aug 23, 2024
·Updated
Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Pipeline Interaction" request
Affected Software
2 affected components
pip/mage-ai<=0.9.73
Mage Mage-ai Python
Event History
Aug 23, 2024
CVE Published
via MITRE·07:16 PM
Data Sourced
via MITRE·07:16 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
Affected Software
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-45190?
The severity of CVE-2024-45190 is considered high due to its potential for remote file leakage.
2
How do I fix CVE-2024-45190?
To fix CVE-2024-45190, it is recommended to upgrade Mage AI to version 0.9.74 or later which addresses the vulnerability.
3
What type of vulnerability is CVE-2024-45190?
CVE-2024-45190 is a path traversal vulnerability that allows unauthorized file access.
4
Who is affected by CVE-2024-45190?
Users of Mage AI versions up to and including 0.9.73 with 'Viewer' role permissions are affected by CVE-2024-45190.
5
Can CVE-2024-45190 be exploited remotely?
Yes, CVE-2024-45190 can be exploited remotely by attackers who have the 'Viewer' role in Mage AI.