PT-2024-34585 · Lunary · Lunary

Published 2024-06-06 · Updated 2024-11-03 · CVE-2024-5128

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions up to and including 1.2.2

Description An Insecure Direct Object Reference (IDOR) vulnerability was identified, allowing unauthorized users to view, update, or delete any dataset prompt or dataset prompt variation within any dataset or project. The issue stems from improper access control checks in the dataset management endpoints, where direct references to object IDs are not adequately secured against unauthorized access.

Recommendations For versions up to and including 1.2.2, upgrade to version 1.2.25 to resolve the issue. As a temporary workaround, consider restricting access to the dataset management endpoints to minimize the risk of exploitation.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-5128

Affected Products

Lunary

References · 8

• 🔥 https://huntr.com/bounties/11248071-11b2-42d9-991a-504bf2044332 · Exploit
• https://github.com/lunary-ai/lunary/commit/0755dde1afc2a74ec23b55eee03e4416916cf48f · Patch
• https://osv.dev/vulnerability/CVE-2024-5128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5128 · Security Note
• https://twitter.com/VulmonFeeds/status/1798821287227523254 · Twitter Post
• https://twitter.com/CveFindCom/status/1798784723495604596 · Twitter Post
• https://t.me/cvenotify/95658 · Telegram Post
• https://twitter.com/CVEnew/status/1798781378429063407 · Twitter Post