An incorrect authorization vulnerability exists in the lunary-ai/lunary repository, specifically within the evaluations.get route in the evaluations API endpoint. This vulnerability allows unauthorized users to retrieve the results of any organization's evaluation by simply knowing the evaluation ID, due to the lack of project ID verification in the SQL query. As a result, attackers can gain access to potentially private data contained within the evaluation results.
References
| Link | Resource |
|---|---|
| https://github.com/lunary-ai/lunary/commit/a4e61122e61dc31460cfbe54d15fae389cc440ce | Patch |
| https://github.com/lunary-ai/lunary/commit/a4e61122e61dc31460cfbe54d15fae389cc440ce | Patch |
| https://huntr.com/bounties/f68ef361-7a5d-4272-9c2f-414baf074309 | Exploit Issue Tracking Patch Third Party Advisory |
| https://huntr.com/bounties/f68ef361-7a5d-4272-9c2f-414baf074309 | Exploit Issue Tracking Patch Third Party Advisory |
Configurations
History
10 Jan 2025, 14:35
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:* | |
| First Time |
Lunary
Lunary lunary |
|
| CWE | ||
| References | () https://github.com/lunary-ai/lunary/commit/a4e61122e61dc31460cfbe54d15fae389cc440ce - Patch | |
| References | () https://huntr.com/bounties/f68ef361-7a5d-4272-9c2f-414baf074309 - Exploit, Issue Tracking, Patch, Third Party Advisory |
16 Apr 2024, 13:24
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-16 00:15
Updated : 2025-01-10 14:35
NVD link : CVE-2024-1738
Mitre link : CVE-2024-1738
JSON object : View
Products Affected
lunary
- lunary
CWE
No CWE.