CVE-2024-5389: medium-severity vulnerability in lunary-ai/lunary
Insufficient Access Control in lunary-ai/lunary
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.7epss 0.4%
In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datasets not owned by their organization. This issue arises due to the application not properly validating the ownership of dataset prompts and their variations against the organization or project of the requesting user. As a result, unauthorized modifications to dataset prompts can occur, leading to altered or removed dataset prompts without proper authorization. This vulnerability impacts the integrity and consistency of dataset information, potentially affecting the results of experiments.
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected products
lunary-ai · lunary-ai/lunaryRelated CVEs — lunary-ai/lunary
In the same product, most dangerous first.
CVE-2024-7476MEDIUMBroken Access Control in lunary-ai/lunaryEPSS 1.5%CVE-2024-7456CRITICALSQL Injection in lunary-ai/lunaryEPSS 1.4%CVE-2024-8765HIGHImproper Path Equivalence Resolution in lunary-ai/lunaryEPSS 0.8%CVE-2024-8789HIGHRegular Expression Denial of Service (ReDoS) in lunary-ai/lunaryEPSS 0.8%CVE-2024-8764HIGHImproper Authorization in lunary-ai/lunaryEPSS 0.8%CVE-2024-8763HIGHRegular Expression Denial of Service (ReDoS) in lunary-ai/lunaryEPSS 0.8%