Vulnerability · Published Oct 29, 2024 · Assigned by @huntr_ai
CVE-2024-7473IDOR Vulnerability in lunary-ai/lunary
High 7.5
In plain English
A high-severity authorization bypass via user-controlled key in lunary-ai/lunary from lunary-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 3.0)7.5High
Exploit odds (30 days)0.4%top 63.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary versions 1.3.2. This vulnerability allows an authenticated user to update other users' prompts by manipulating the 'id' parameter in the request. The issue is fixed in version 1.4.3.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| lunary-ai | lunary-ai/lunary | unspecified – before 1.4.3 |
Weakness: CWE-639 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N