PT-2024-34593 · Lunary Ai · Lunary

Published 2024-06-06 · Updated 2024-11-03 · CVE-2024-5131

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions up to and including 1.2.2

Description An Improper Access Control issue exists, allowing unauthorized users to view any prompts in any projects by supplying a specific prompt ID to an endpoint that does not adequately verify the ownership of the prompt ID.

Recommendations For versions up to and including 1.2.2, update to version 1.2.25 to resolve the issue. As a temporary workaround, consider restricting access to the affected endpoint until the update is applied.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-5131

Affected Products

Lunary

References · 6

• 🔥 https://huntr.com/bounties/52c129f2-114e-492f-aee8-32c78f75ac4f · Exploit
• https://github.com/lunary-ai/lunary/commit/ddfd497afd017a6946c582a1a806687fdac888bf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-5131 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5131 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1798822300088725909 · Twitter Post
• https://twitter.com/CVEnew/status/1798789765523030335 · Twitter Post