Lucene search

@huntr_aiCVE-2024-5130

HistoryJun 06, 2024 - 7:16 p.m.

CVE-2024-5130

2024-06-0619:16:04

CWE-863

@huntr_ai

web.nvd.nist.gov

incorrect authorization

vulnerability

lunary-ai/lunary

unauthenticated users

delete

dataset

endpoint

project id

authentication

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.2

Confidence

Low

EPSS

Percentile

9.0%

JSON

An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.

Affected configurations

Vulners

Vulnrichment

Node

lunary-ailunary-ai\/lunaryMatch1.2.8

VendorProductVersionCPE
lunary-ailunary-ai\/lunary1.2.8cpe:2.3:a:lunary-ai:lunary-ai\/lunary:1.2.8:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lunary-ai	lunary-ai\/lunary	1.2.8	cpe:2.3:a:lunary-ai:lunary-ai\/lunary:1.2.8:::::::*

CNA Affected

[
  {
    "vendor": "lunary-ai",
    "product": "lunary-ai/lunary",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "1.2.8",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776

huntr.com/bounties/e81a9871-308d-4628-9726-af66643a16fe

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.2

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-5130