CVE-2024-1625

Katalog CVE

CVSS 6.5 · Medium EPSS 0,44%

Kerentanan Authorization Bypass Through User-Controlled Key pada lunary. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organization's project. The vulnerability is due to insufficient authorization checks in the project deletion endpoint, where the endpoint fails to verify if the project ID provided in the request belongs to the requesting user's organization. As a result, an attacker can delete projects belonging to any organization by sending a crafted DELETE request with the target project's ID. This issue affects the project deletion functionality implemented in the projects.delete route.

Rincian

Terbit di NVD

10 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lunary-ai/lunary/commit/88f98e29f19da9d1f5de45c5b163fd5b48e0bcec patch
• https://huntr.com/bounties/cf6dd625-e6c9-44df-a072-13686816de21 exploit · issue tracking · patch · advisory pihak ketiga