CVE-2024-11300highCWE-639

CVE-2024-11300: high-severity vulnerability in lunary-ai/lunary

Improper Access Control in lunary-ai/lunary

Published · Updated

Follow this CVE+ Monitor lunary-ai/lunary

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.7%
In short

A user could view another user's private prompt data by accessing certain URLs in the Lunary application. This is a serious security problem because it exposes sensitive information that should be kept private.

Technical detail

Improper access control in Lunary versions before 1.6.3 allows horizontal privilege escalation via URL manipulation to retrieve prompt data belonging to other users. The vulnerability requires authentication but no additional pre-conditions; impact includes unauthorized disclosure of confidential prompt information.

Summary generated and translated by AI from the official description.
In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can access prompt data of another user. This issue affects version 1.6.2 and the main branch. The vulnerability allows unauthorized users to view sensitive prompt data by accessing specific URLs, leading to potential exposure of critical information.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
lunary-ai · lunary-ai/lunary
Related CVEs — lunary-ai/lunary

In the same product, most dangerous first.

CVE-2024-7476MEDIUMBroken Access Control in lunary-ai/lunaryEPSS 1.5%CVE-2024-7456CRITICALSQL Injection in lunary-ai/lunaryEPSS 1.4%CVE-2024-8765HIGHImproper Path Equivalence Resolution in lunary-ai/lunaryEPSS 0.8%CVE-2024-8789HIGHRegular Expression Denial of Service (ReDoS) in lunary-ai/lunaryEPSS 0.8%CVE-2024-8764HIGHImproper Authorization in lunary-ai/lunaryEPSS 0.8%CVE-2024-8763HIGHRegular Expression Denial of Service (ReDoS) in lunary-ai/lunaryEPSS 0.8%