An Improper Access Control vulnerability exists in the lunary-ai/lunary repository, affecting versions up to and including 1.2.2. The vulnerability allows unauthorized users to view any prompts in any projects by supplying a specific prompt ID to an endpoint that does not adequately verify the ownership of the prompt ID. This issue was fixed in version 1.2.25.
History

Sun, 03 Nov 2024 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Sun, 03 Nov 2024 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Lunary-ai
Lunary-ai lunary
CPEs cpe:2.3:a:lunary-ai:lunary:0:*:*:*:*:*:*:*
Vendors & Products Lunary-ai
Lunary-ai lunary
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 03 Oct 2024 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Lunary
Lunary lunary
Weaknesses CWE-639
CPEs cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:*
Vendors & Products Lunary
Lunary lunary
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published: 2024-06-06T18:31:16.725Z

Updated: 2024-11-03T18:27:24.663Z

Reserved: 2024-05-19T18:14:50.387Z

Link: CVE-2024-5131

cve-icon Vulnrichment

Updated: 2024-08-01T21:03:10.967Z

cve-icon NVD

Status : Modified

Published: 2024-06-06T19:16:05.060

Modified: 2024-11-21T09:47:02.353

Link: CVE-2024-5131

cve-icon Redhat

No data.