PT-2024-18263 · Unknown · Lunary-Ai/Lunary

Published 2024-04-15 · Updated 2025-01-10 · CVE-2024-1738

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary (affected versions not specified)

Description An incorrect authorization issue exists in the lunary-ai/lunary repository, specifically within the evaluations.get route in the evaluations API endpoint "/api/evaluations". This issue allows unauthorized users to retrieve the results of any organization's evaluation by simply knowing the evaluation ID, due to the lack of project ID verification in the SQL query. As a result, attackers can gain access to potentially private data contained within the evaluation results.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-1738

Affected Products

Lunary-Ai/Lunary

References · 8

• 🔥 https://huntr.com/bounties/f68ef361-7a5d-4272-9c2f-414baf074309 · Exploit
• https://github.com/lunary-ai/lunary/commit/a4e61122e61dc31460cfbe54d15fae389cc440ce · Patch
• https://osv.dev/vulnerability/CVE-2024-1738 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1738 · Security Note
• https://t.me/cvenotify/107028 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1780116333746696429 · Twitter Post
• https://t.me/cvenotify/79853 · Telegram Post
• https://twitter.com/CVEnew/status/1780039214719201724 · Twitter Post