CVE-2024-1741

CVSS V2 None CVSS V3 None

Description

lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by sending HTTP requests with their previously captured authorization token. This issue exposes organizations to unauthorized access and manipulation of sensitive template data.

Overview

CVE ID
CVE-2024-1741

Assigner
@huntr_ai

Vulnerability Status
PUBLISHED

Published Version
2024-04-10T17:08:04.411Z

Last Modified Date
2024-04-16T11:10:32.533Z

Weakness Enumerations

CWE	URL
CWE-285	http://cwe.mitre.org/data/definitions/285.html

References

Reference URL	Reference Tags
https://huntr.com/bounties/671bd040-1cc5-4227-8182-5904e9c5ed3b
https://github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-1741
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1741

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 06:17:14				Added to TrackCVE