CVE-2024-5130

Katalog CVE

CVSS 7.5 · High EPSS 0,48%

Kerentanan Missing Authorization pada lunary. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.

Rincian

Terbit di NVD

6 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776 patch
• https://huntr.com/bounties/e81a9871-308d-4628-9726-af66643a16fe exploit · issue tracking · patch · advisory pihak ketiga