PT-2024-18210 · Lunary Ai · Lunary

Published 2024-04-15 · Updated 2024-06-07 · CVE-2024-1665

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.0.0

Description The issue concerns unauthorized evaluation creation due to missing server-side checks for user account status during evaluation creation. Although the web UI restricts evaluation creation, the lack of server-side checks allows for potential unauthorized access.

Recommendations For lunary-ai/lunary version 1.0.0, consider implementing server-side checks for user account status during evaluation creation to prevent unauthorized access. As a temporary workaround, restrict evaluation creation to authorized users until a patch is available.

Related Identifiers

CVE-2024-1665

Affected Products

Lunary

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-1665 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1665 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1780114308812152881 · Twitter Post
• https://twitter.com/CVEnew/status/1780039209858023453 · Twitter Post