VulnerabilityModified

CVE-2024-11300

In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can access prompt data of another user.

MEDIUM 6.5EPSS 0.70%

Does this matter?

Lower severity and a low EPSS score (0.70%). Track it; it rarely justifies an emergency change on its own.

Description

In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can access prompt data of another user. This issue affects version 1.6.2 and the main branch. The vulnerability allows unauthorized users to view sensitive prompt data by accessing specific URLs, leading to potential exposure of critical information.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.70% probability · 51th percentile
CISA KEV: Not listed
Weakness: CWE-639
Affected: lunary/lunary
Source: security@huntr.dev

References

https://github.com/lunary-ai/lunary/commit/79dc370596d979b756f6ea0250d97a2d02385ecdPatch
https://huntr.com/bounties/8dca7994-0d92-491e-a419-02adfe23ffa4Exploit
https://huntr.com/bounties/8dca7994-0d92-491e-a419-02adfe23ffa4Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.