CVE-2024-8072

Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users

Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users

Affected

mage-ai

CVSS v4.0 GitHub

6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS v3.1 JFROG

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.60% chance of exploitation in the next 30 days, 47th percentile

Published

2024-08-22

Updated

2024-11-25

Proof-of-concept exploits (1)

• https://research.jfrog.com/vulnerabilities/mage-ai-terminal-server-infoleak-jfsa-2024-001…

Security advisories

• https://research.jfrog.com/vulnerabilities/mage-ai-terminal-server-infoleak-jfsa-2024-001…
• advisories/GHSA-cgrq-wvfj-v28j

References

• CVE Record
• NVD entry