High severity · published Aug 23, 2024
CVE-2024-45187
Mage AI allows deleted users to use the terminal server with admin access, leading to remote code execution
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mage-ai · Mage
0 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45187
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45187
Third Party Advisory
https://research.jfrog.com/vulnerabilities/mage-ai-deleted-users-rce-jfsa-2024-001039602/
More from Mage-ai
9.8
CVE-2026-111823
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider
9.8
CVE-2023-31143
Mage terminal user authentication not working properly
6.5
CVE-2024-45190
Mage AI pipeline interaction request remote arbitrary file leak
6.5
CVE-2024-45189
Mage AI git content request remote arbitrary file leak
6.5
CVE-2024-45188
Mage AI file content request remote arbitrary file leak