CVE-2024-45187

Mage AI allows deleted users to use the terminal server with admin access, leading to remote code execution

State: Published
Severity: 7.1 High
Published: Aug 23, 2024
Updated: Nov 25, 2024
Reserved: Aug 22, 2024

Description

Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H	JFROG

Weaknesses

CWE-613 Insufficient Session Expiration
CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
mage-ai	0Affected

References

https://research.jfrog.com/vulnerabilities/mage-ai-deleted-users-rce-jfsa-2024-001039602/third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.