CVE-2024-4154

Incorrect Synchronization in lunary-ai/lunary

Severity Score

7.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

In lunary-ai/lunary version 1.2.2, an incorrect synchronization vulnerability allows unprivileged users to rename projects they do not have access to. Specifically, an unprivileged user can send a PATCH request to the project's endpoint with a new name for a project, despite not having the necessary permissions or being assigned to the project. This issue allows for unauthorized modification of project names, potentially leading to confusion or unauthorized access to project resources.

En lunary-ai/lunary versión 1.2.2, una vulnerabilidad de sincronización incorrecta permite a usuarios sin privilegios cambiar el nombre de proyectos a los que no tienen acceso. Específicamente, un usuario sin privilegios puede enviar una solicitud PATCH al endpoint del proyecto con un nuevo nombre para un proyecto, a pesar de no tener los permisos necesarios o no estar asignado al proyecto. Este problema permite la modificación no autorizada de los nombres de los proyectos, lo que podría generar confusión o acceso no autorizado a los recursos del proyecto.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

Complete

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

Poc

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-04-24 CVE Reserved
2024-05-21 CVE Published
2025-01-11 EPSS Updated
2025-01-31 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-639: Authorization Bypass Through User-Controlled Key
CWE-821: Incorrect Synchronization

CAPEC

References (2)

URL	Tag	Source
https://huntr.com/bounties/e56509af-f7af-4e1e-a04b-9cb53545f30f
https://github.com/lunary-ai/lunary/commit/c43b6c62035f32ca455f66d5fd22ba661648cde7

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Lunary-ai Search vendor "Lunary-ai"		Lunary Search vendor "Lunary-ai" for product "Lunary"				*		-		Affected
Lunary Search vendor "Lunary"		Lunary Search vendor "Lunary" for product "Lunary"				*		-		Affected