A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The vulnerability is present in the dataset deletion functionality, where the application fails to verify if the user requesting the deletion has the appropriate permissions. This allows unauthorized users to send a DELETE request to the server and delete any dataset by specifying its ID. The issue is located in the datasets.delete function within the datasets index file.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/a6c0deb3-6a4c-4188-8aaa-9e6207f82f44 | Exploit Issue Tracking Patch Third Party Advisory |
| https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776 | Patch |
Configurations
History
03 Oct 2024, 16:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776 - Patch | |
| References | () https://huntr.com/bounties/a6c0deb3-6a4c-4188-8aaa-9e6207f82f44 - Exploit, Issue Tracking, Patch, Third Party Advisory | |
| CPE | cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:* | |
| First Time |
Lunary lunary
Lunary |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.2 |
| CWE | CWE-862 |
06 Jun 2024, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-06 19:16
Updated : 2024-10-03 16:56
NVD link : CVE-2024-5129
Mitre link : CVE-2024-5129
JSON object : View
Products Affected
lunary
- lunary
CWE
CWE-862
Missing Authorization