An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.
History

Sun, 03 Nov 2024 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-863

Sun, 03 Nov 2024 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Lunary-ai
Lunary-ai lunary
CPEs cpe:2.3:a:lunary-ai:lunary:*:*:*:*:*:*:*:*
Vendors & Products Lunary-ai
Lunary-ai lunary
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 03 Oct 2024 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Lunary
Lunary lunary
Weaknesses CWE-639
CPEs cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:*
Vendors & Products Lunary
Lunary lunary
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published: 2024-06-06T18:43:30.816Z

Updated: 2024-11-03T18:27:24.112Z

Reserved: 2024-05-19T17:58:52.061Z

Link: CVE-2024-5130

cve-icon Vulnrichment

Updated: 2024-08-01T21:03:10.695Z

cve-icon NVD

Status : Modified

Published: 2024-06-06T19:16:04.813

Modified: 2024-11-21T09:47:02.230

Link: CVE-2024-5130

cve-icon Redhat

No data.