PT-2025-12034 · Unknown · Lunary-Ai/Lunary

Published 2025-03-20 · Updated 2025-07-02 · CVE-2024-10273

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.5.0

Description The issue is related to improper privilege management in the models.ts file, which allows users with viewer roles to modify models owned by others. The "PATCH" endpoint for models lacks appropriate privilege checks, enabling low-privilege users to update models they should not have access to modify. This could lead to unauthorized changes in critical resources, affecting the integrity and reliability of the system.

Recommendations For lunary-ai/lunary version 1.5.0, consider disabling the models.ts file or restricting access to the "PATCH" endpoint for models until a patch is available. Additionally, restrict the viewer role from modifying models to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

CVE-2024-10273

Affected Products

Lunary-Ai/Lunary

References · 6

• 🔥 https://huntr.com/bounties/883d9fe2-5730-41e1-a5c2-59972489876e · Exploit
• https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-10273 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10273 · Vendor Advisory
• https://t.me/cvenotify/127482 · Telegram Post
• https://twitter.com/CVEnew/status/1903336850972086517 · Twitter Post