PT-2024-9681 · Lunary Ai · Lunary

Published 2024-10-29 · Updated 2024-11-03 · CVE-2024-7473

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions 1.3.2 through 1.4.2

Description The issue is related to an IDOR vulnerability in the 'Evaluations' function of the 'umgws datasets' section. This vulnerability allows an authenticated user to update other users' prompts by manipulating the id parameter in the request.

Recommendations For versions 1.3.2 through 1.4.2, update to version 1.4.3 to resolve the issue. As a temporary workaround, consider restricting access to the 'Evaluations' function in the 'umgws datasets' section until the update is applied. Avoid using the id parameter in the affected request until the issue is resolved.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2024-11393

CVE-2024-7473

Affected Products

Lunary

References · 6

• 🔥 https://huntr.com/bounties/afecd927-b5f6-44ba-9147-5c45091beda5 · Exploit
• https://github.com/lunary-ai/lunary/commit/88b55b01fcbab0fbbc5b8032a38d0345af98ecfa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-7473 · Security Note
• https://bdu.fstec.ru/vul/2024-11393 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7473 · Vendor Advisory
• https://t.me/cvedetector/9316 · Telegram Post