CVE-2024-3761 Missing Authorization on Delete Datasets in lunary-ai/lunary

Critical 9.1 Published 20 May 2024 Updated 1 Aug 2024

Attackers can delete datasets without authentication due to missing authorization checks, causing data loss and service disruption.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-3761?

CVE-2024-3761 is a critical missing authorization vulnerability in Lunary Lunary, published on 20 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In lunary-ai/lunary version 1.2.2, the DELETE endpoint located at `packages/backend/src/api/v1/datasets` is vulnerable to unauthorized dataset deletion due to missing authorization and authentication mechanisms. This vulnerability allows any user, even those without a valid token, to delete a dataset by sending a DELETE request to the endpoint. The issue was fixed in version 1.2.8. The impact of this vulnerability is significant as it permits unauthorized users to delete datasets, potentially leading to data loss or disruption of service.

Weakness: CWE-862

Which versions are affected by CVE-2024-3761?

It affects 1 product.

Products include Lunary Lunary.

How do I fix CVE-2024-3761?

No fix has been published for CVE-2024-3761 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-3761 being exploited?

There is no known exploitation of CVE-2024-3761 in the wild and no public exploit code.

All Lunary Lunary vulnerabilities

Sources

Also known as GHSA-56p3-wxg9-vx4g.