{"id":"CVE-2023-31143","aliases":["EUVD-2023-0128","GHSA-c6mm-2g84-v4m7","PYSEC-2023-64"],"status":"published","title":"Mage terminal user authentication not working properly","description":"mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00659,"percentile":0.51975,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306"],"published":"2023-05-05T23:10:44Z","modified":"2026-10-28T02:30:56Z","fixes":[{"ecosystem":"PyPI","package":"mage-ai","fixed_in":["0.8.72"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mage-ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.34"},{"fixed":"0.8.72"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mage-ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.34"},{"fixed":"0.8.72"}]}],"versions":["0.8.34","0.8.35","0.8.36","0.8.37","0.8.38","0.8.39","0.8.40","0.8.41","0.8.42","0.8.43","0.8.44","0.8.45","0.8.46","0.8.47","0.8.48","0.8.49","0.8.50","0.8.51","0.8.52","0.8.53","0.8.54","0.8.55","0.8.56","0.8.57","0.8.58","0.8.59","0.8.60","0.8.61","0.8.62","0.8.63","0.8.64","0.8.66","0.8.67","0.8.68","0.8.69","0.8.70","0.8.71"]},{"source":"osv","ecosystem":"PyPI","package":"mage-ai","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"f63cd00f6a3be372397d37a4c9a49bfaf50d7650"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0.8.34"},{"fixed":"0.8.72"}]}],"versions":["0.8.34","0.8.35","0.8.36","0.8.37","0.8.38","0.8.39","0.8.40","0.8.41","0.8.42","0.8.43","0.8.44","0.8.45","0.8.46","0.8.47","0.8.48","0.8.49","0.8.50","0.8.51","0.8.52","0.8.53","0.8.54","0.8.55","0.8.56","0.8.57","0.8.58","0.8.59","0.8.60","0.8.61","0.8.62","0.8.63","0.8.64","0.8.66","0.8.67","0.8.68","0.8.69","0.8.70","0.8.71"]}],"products":[{"vendor":"mage","product":"mage-ai"},{"vendor":"mage-ai","product":"mage-ai"}],"references":[{"url":"https://github.com/mage-ai/mage-ai/security/advisories/GHSA-c6mm-2g84-v4m7","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/mage-ai/mage-ai/commit/f63cd00f6a3be372397d37a4c9a49bfaf50d7650","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31143","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/mage-ai/PYSEC-2023-64.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c6mm-2g84-v4m7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31143.json","tags":["advisory"]},{"url":"https://github.com/mage-ai/mage-ai","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-31143","title":"Mage terminal user authentication not working properly","description":"mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.","status":"published","published":"2023-05-09T14:59:42.33Z","modified":"2025-01-28T16:58:09.069Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:35:27.430605Z"}],"euvd":[{"id":"EUVD-2023-0128","description":"mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.","status":"published","published":"2023-05-09T14:59:42Z","modified":"2025-01-28T16:58:09Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:11.289823Z"}],"ghsa":[{"id":"GHSA-c6mm-2g84-v4m7","title":"Mage-ai missing user authentication","description":"### Impact\n\nYou may be impacted if you're using Mage with user authentication enabled. The terminal could be accessed by users who are not signed in or do not have editor permissions.\n\n### Patches\n\nThe vulnerability has been resolved in Mage version 0.8.72.","status":"published","published":"2023-05-05T23:10:44Z","modified":"2024-09-30T16:51:21Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:38:06.988799Z"}],"nvd":[{"id":"CVE-2023-31143","description":"mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.","status":"published","published":"2023-05-09T15:15:10.303Z","modified":"2026-06-17T05:56:22.367Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:08:01.131774Z"}],"osv":[{"id":"CVE-2023-31143","title":"Mage terminal user authentication not working properly","description":"mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.","status":"published","published":"2023-05-09T14:59:42.33Z","modified":"2026-10-28T02:30:56.901455361Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"GHSA-c6mm-2g84-v4m7","title":"Mage-ai missing user authentication","description":"### Impact\n\nYou may be impacted if you're using Mage with user authentication enabled. The terminal could be accessed by users who are not signed in or do not have editor permissions.\n\n### Patches\n\nThe vulnerability has been resolved in Mage version 0.8.72.","status":"published","published":"2023-05-05T23:10:44Z","modified":"2024-09-30T17:01:34.013781Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"PYSEC-2023-64","description":"mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.","status":"published","published":"2023-05-09T15:15:00Z","modified":"2023-11-08T04:12:29.944518Z","updated_at":"2026-11-02T15:52:53.837392Z"}]}}