Auth bypass in Lunary
CVE-2024-5130
An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.005 (39.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 39.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Lunary
- Lunary-Ai Lunary-Ai/lunary — versions unspecified
Weakness classification (CWE)
Public proof-of-concept exploits
References
- huntr.com/bounties/e81a9871-308d-4628-9726-af66643a16fe (Exploit, Patch, Third Party Advisory, Issue Tracking)
- github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776 (Patch)
Frequently asked questions
- What is CVE-2024-5130?
- CVE-2024-5130 is a high-severity vulnerability in Lunary, classified under Missing Authorization. CVSS score: 7.5/10. Published 2024-06-06.
- How severe is CVE-2024-5130?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2024-5130 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.