Lucene search

@huntr_aiCVELIST:CVE-2024-1741

HistoryApr 10, 2024 - 5:08 p.m.

CVE-2024-1741 Improper Authorization in lunary-ai/lunary

2024-04-1017:08:04

CWE-285

@huntr_ai

www.cve.org

improper authorization

vulnerability

lunary-ai

lunary

version 1.0.1

removed members

sensitive template data

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by sending HTTP requests with their previously captured authorization token. This issue exposes organizations to unauthorized access and manipulation of sensitive template data.

CNA Affected

[
  {
    "vendor": "lunary-ai",
    "product": "lunary-ai/lunary",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "1.2.8",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2

huntr.com/bounties/671bd040-1cc5-4227-8182-5904e9c5ed3b

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for CVELIST:CVE-2024-1741