Lucene search

@huntr_aiCVELIST:CVE-2024-5128

HistoryJun 06, 2024 - 6:08 p.m.

CVE-2024-5128 IDOR Vulnerability in lunary-ai/lunary

2024-06-0618:08:23

CWE-284

@huntr_ai

www.cve.org

idor

lunary-ai

unauthorized access

dataset_prompt

dataset management

version 1.2.2

version 1.2.25

9.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

0.0004 Low

EPSS

Percentile

9.1%

JSON

An Insecure Direct Object Reference (IDOR) vulnerability was identified in lunary-ai/lunary, affecting versions up to and including 1.2.2. This vulnerability allows unauthorized users to view, update, or delete any dataset_prompt or dataset_prompt_variation within any dataset or project. The issue stems from improper access control checks in the dataset management endpoints, where direct references to object IDs are not adequately secured against unauthorized access. This vulnerability was fixed in version 1.2.25.

CNA Affected

[
  {
    "vendor": "lunary-ai",
    "product": "lunary-ai/lunary",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "1.2.25",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/lunary-ai/lunary/commit/0755dde1afc2a74ec23b55eee03e4416916cf48f

huntr.com/bounties/11248071-11b2-42d9-991a-504bf2044332

9.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for CVELIST:CVE-2024-5128