PRIOn Logo

CVE-2024-5130 Authorization

Routine
Remediate Within 6 Months

CVE Information

Original CVE data

Published:
Updated:

An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.

CWE: CWE-863
CVSS v2-
CVSS v3-
References
https://huntr.com/bounties/e81a9871-308d-4628-9726-af66643a16fe
https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776
Affected Vendors

Basic Analysis

Common vulnerability metrics

Vulnerabilty type as detected by PRIOnengine

Authorization

CVSS Scores as calculated by PRIOnengine
CVSS v26.4
AV:N/AC:L/AU:N/C:N/I:P/A:P
CVSS v37.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
MITRE CWE Top 25

-

Exploits

No exploit code is reported to exist.

Active Exploitation

Vulnerability is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. See the KEV Catalog

Social Network Activity

-

Threat Actor Activity

No sightings of the vulnerability within threat reports.

Cybersecurity Frameworks

How the vulnerability maps against various cybersecurity frameworks

-

Compliance Impact

How the submited vulnerability affects compliance

-

Web Application Security Frameworks

Applicable if the issue likely affects a web application

-