by Kastro
Paper/Archive/CVE-2024-7474

CVE-2024-7474

lunary-ai lunary-ai/lunary — IDOR in lunary-ai/lunary

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 46.5.465 × 209.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists. A user can view or delete external users by manipulating the 'id' parameter in the request URL. The application does not perform adequate checks on the 'id' parameter, allowing unauthorized access to external user data.

Affected

ProductAffectedFixed inSource
lunary-ai/lunaryunspecified – < 1.3.41.3.4CNA
lunary< 1.3.41.3.4CISA-ADP

Scores by source

@huntr_ai (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refhuntr.com/bounties/95d8b993-3347-4ef5-a2b3-1f57219b7871refgithub.com/lunary-ai/lunary/commit/8f563c77d8614a72980113f530c7a9ec15a5f8d5