Auth bypass in Lunary
CVE-2024-5129
A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The vulnerability is present in the dataset deletion functionality, where the application fails to verify if the user requesting the deletion has the appropriate permissions. This allows unauthorized users to send a DELETE request to the server and delete any dataset by specifying its ID. The issue is located in the datasets.delete function within the datasets index file.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L.
EPSS exploit prediction
EPSS: 0.004 (36.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 36.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Lunary
- Lunary-Ai Lunary-Ai/lunary — versions unspecified
Weakness classification (CWE)
Public proof-of-concept exploits
References
- huntr.com/bounties/a6c0deb3-6a4c-4188-8aaa-9e6207f82f44 (Exploit, Patch, Third Party Advisory, Issue Tracking)
- github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776 (Patch)
Frequently asked questions
- What is CVE-2024-5129?
- CVE-2024-5129 is a high-severity vulnerability in Lunary, classified under Missing Authorization. CVSS score: 8.2/10. Published 2024-06-06.
- How severe is CVE-2024-5129?
- High severity. CVSS v3 base score is 8.2 out of 10.
- Is CVE-2024-5129 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.