lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by sending HTTP requests with their previously captured authorization token. This issue exposes organizations to unauthorized access and manipulation of sensitive template data.
References
| Link | Resource |
|---|---|
| https://github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2 | Patch |
| https://github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2 | Patch |
| https://huntr.com/bounties/671bd040-1cc5-4227-8182-5904e9c5ed3b | Exploit Issue Tracking Patch Third Party Advisory |
| https://huntr.com/bounties/671bd040-1cc5-4227-8182-5904e9c5ed3b | Exploit Issue Tracking Patch Third Party Advisory |
Configurations
History
10 Jan 2025, 14:27
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
| CWE | CWE-863 | |
| First Time |
Lunary
Lunary lunary |
|
| References | () https://github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2 - Patch | |
| References | () https://huntr.com/bounties/671bd040-1cc5-4227-8182-5904e9c5ed3b - Exploit, Issue Tracking, Patch, Third Party Advisory | |
| CPE | cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:* |
15 Apr 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
10 Apr 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-10 17:15
Updated : 2025-01-31 11:15
NVD link : CVE-2024-1741
Mitre link : CVE-2024-1741
JSON object : View
Products Affected
lunary
- lunary
CWE
CWE-863
Incorrect Authorization