VulnerabilityModified

CVE-2024-7476

A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2.

MEDIUM 4.3EPSS 1.46%

Does this matter?

Lower severity and a low EPSS score (1.46%). Track it; it rarely justifies an emergency change on its own.

Description

A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.

CVSS 3.0: 4.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS: 1.46% probability · 72th percentile
CISA KEV: Not listed
Weakness: CWE-639
Affected: lunary/lunary
Source: security@huntr.dev

References

https://github.com/lunary-ai/lunary/commit/8f563c77d8614a72980113f530c7a9ec15a5f8d5Patch
https://huntr.com/bounties/183761f7-d411-4332-af86-2ccfbcc5bd9fExploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.