CVE-2024-11301

Katalog CVE

CVSS 6.5 · Medium EPSS 0,59%

Kerentanan Improper Enforcement of a Single, Unique Action pada lunary. Skor CVSS 3.0 6.5 (Medium) menurut huntr.dev.

Deskripsi (NVD)

In lunary-ai/lunary before version 1.6.3, the application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This allows an attacker to overwrite existing data by submitting a POST request with the same slug as an existing evaluator. The lack of database constraints or application-layer validation to prevent duplicates exposes the application to data integrity issues. This vulnerability can result in corrupted data and potentially malicious actions, impairing the system's functionality.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.0

6.5 (Medium), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-837: Improper Enforcement of a Single, Unique Action

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lunary-ai/lunary/commit/79dc370596d979b756f6ea0250d97a2d02385ecd patch
• https://huntr.com/bounties/3d99aca5-b135-4833-b48b-7806bc4bf861 exploit · advisory pihak ketiga