Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users
Date: 2024-08
Affected: pip/mage-ai
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-8072
CWE: CWE-200
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users.


Mitigations:

Architectural layers (MAESTRO):