by Kastro
Paper/Archive/CVE-2024-3379

CVE-2024-3379

lunary-ai lunary-ai/lunary — Incorrect Authorization in lunary-ai/lunary

EPSS 0.4%public exploitCVSS 9.6
critical.is priorityof 100
46
CVSS 9.6 (CNA, ADP agree)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 33.7.337 × 206.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

In lunary-ai/lunary versions 1.2.2 through 1.2.6, an incorrect authorization vulnerability allows unprivileged users to re-generate the private key for projects they do not have access to. Specifically, a user with a 'Member' role can issue a request to regenerate the private key of a project without having the necessary permissions or being assigned to that project. This issue was fixed in version 1.2.7.

Affected

ProductAffectedFixed inSource
lunary-ai/lunaryunspecified – < 1.2.71.2.7CNA
lunary-ai\/lunary< 1.2.71.2.7CISA-ADP

Scores by source

@huntr_ai (CNA)9.6CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA ADP9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refhuntr.com/bounties/739df024-a112-47aa-b51d-988c3f855e92refgithub.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54