CVE-2024-1738 Incorrect Authorization in lunary-ai/lunary
Attackers can access private evaluation results from any organization by knowing the evaluation ID due to missing project verification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-1738?
CVE-2024-1738 is a high-severity missing authorization vulnerability in Lunary Lunary, published on 16 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An incorrect authorization vulnerability exists in the lunary-ai/lunary repository, specifically within the evaluations.get route in the evaluations API endpoint. This vulnerability allows unauthorized users to retrieve the results of any organization's evaluation by simply knowing the evaluation ID, due to the lack of project ID verification in the SQL query. As a result, attackers can gain access to potentially private data contained within the evaluation results.
Weakness: CWE-863
Which versions are affected by CVE-2024-1738?
It affects 1 product.
Products include Lunary Lunary.
How do I fix CVE-2024-1738?
No fix has been published for CVE-2024-1738 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-1738 being exploited?
There is no known exploitation of CVE-2024-1738 in the wild and no public exploit code.
Other vulnerabilities in Lunary Lunary
- CVE-2024-8999 Improper Access Control in lunary-ai/lunary
- CVE-2024-9095 Improper Authorization in lunary-ai/lunary
- CVE-2024-7456 SQL Injection in lunary-ai/lunary
- CVE-2024-4146 Incorrect Authorization in lunary-ai/lunary
- CVE-2024-5386 Account Hijacking via Password Reset Token Leak in lunary-ai/lunary
Sources
Also known as GHSA-pcfp-5frw-85m7.