Vulnerability · Published Apr 10, 2024 · Assigned by @huntr_ai

CVE-2024-1643Unauthorized Organization Access in lunary-ai/lunary

Critical 9.1

In plain English

A critical-severity information exposure in lunary-ai/lunary from lunary-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.0)9.1Critical

Exploit odds (30 days)0.7%top 47.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data within that organization. This vulnerability allows unauthorized access and modification of sensitive information, posing a significant security risk. The flaw is due to insufficient verification of user permissions when joining an organization.

Affected products (as reported)

Vendor	Product	Versions
lunary-ai	lunary-ai/lunary	unspecified – before 1.2.2

Weakness: CWE-200 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

In plain English

Official description

Affected products (as reported)

References