CVE-2024-8765: high-severity vulnerability in lunary-ai/lunary
Improper Path Equivalence Resolution in lunary-ai/lunary
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.3epss 0.8%
In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4. The system incorrectly identifies certain endpoints as public if the path contains '/auth/' anywhere within it. This allows unauthenticated attackers to access sensitive endpoints by including '/auth/' in the path. As a result, attackers can obtain and modify sensitive data and utilize other organizations' resources without proper authentication.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
lunary-ai · lunary-ai/lunaryRelated CVEs — lunary-ai/lunary
In the same product, most dangerous first.
CVE-2024-7476MEDIUMBroken Access Control in lunary-ai/lunaryEPSS 1.5%CVE-2024-7456CRITICALSQL Injection in lunary-ai/lunaryEPSS 1.4%CVE-2024-8789HIGHRegular Expression Denial of Service (ReDoS) in lunary-ai/lunaryEPSS 0.8%CVE-2024-8764HIGHImproper Authorization in lunary-ai/lunaryEPSS 0.8%CVE-2024-8763HIGHRegular Expression Denial of Service (ReDoS) in lunary-ai/lunaryEPSS 0.8%CVE-2024-8998HIGHRegular Expression Denial of Service (ReDoS) in lunary-ai/lunaryEPSS 0.8%