PT-2024-34584 · Lunary · Lunary

Published 2024-06-06 · Updated 2024-11-03 · CVE-2024-5127

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions 1.2.2 through 1.2.25

Description The issue arises due to insufficient backend validation of roles and permissions, enabling unauthorized users to join a project and potentially exploit roles and permissions not intended for their use. This specifically affects the Team feature, where the backend fails to validate whether a user has paid for a plan before allowing them to send invite links with any role assigned. This could lead to unauthorized access and manipulation of project settings or data.

Recommendations For versions 1.2.2 through 1.2.25, as a temporary workaround, consider disabling the Team feature until a patch is available. Restrict access to the Team feature to minimize the risk of exploitation. Avoid using the role assignment feature in the Team feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-5127

Affected Products

Lunary

References · 7

• 🔥 https://huntr.com/bounties/719a5db3-f943-4100-a660-011cadf1bb32 · Exploit
• https://github.com/lunary-ai/lunary/commit/b7bd3a830a0f47ba07d0fd57bf78c4dd8a216297 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-5127 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5127 · Vendor Advisory
• https://t.me/cvenotify/100417 · Telegram Post
• https://twitter.com/CVEnew/status/1798771697602187334 · Twitter Post
• https://t.me/cvenotify/97602 · Telegram Post