4.3

CVE-2024-7476

Exploit

Broken Access Control in lunary-ai/lunary

A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lunary ≫ Lunary Version >= 1.2.7 < 1.4.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.4% 0.688
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@huntr.dev 4.3 2.8 1.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://github.com/lunary-ai/lunary/commit/8f563c77d8614a72980113f530c7a9ec15a5f8d5
Patch
https://huntr.com/bounties/183761f7-d411-4332-af86-2ccfbcc5bd9f
Third Party Advisory
Exploit