CVE-2024-5129: Privilege Escalation Vulnerability in lunary-ai/lunary
First published: Thu Jun 06 2024(Updated: )
A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The vulnerability is present in the dataset deletion functionality, where the application fails to verify if the user requesting the deletion has the appropriate permissions. This allows unauthorized users to send a DELETE request to the server and delete any dataset by specifying its ID. The issue is located in the datasets.delete function within the datasets index file.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| lunary lunary | <1.2.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-5129?
CVE-2024-5129 is classified as a privilege escalation vulnerability.
How do I fix CVE-2024-5129?
To fix CVE-2024-5129, ensure proper authorization checks are implemented for dataset deletion functionality.
What versions of Lunary are affected by CVE-2024-5129?
CVE-2024-5129 affects Lunary version 1.2.2 and earlier versions up to 1.2.8.
What kind of attacks can CVE-2024-5129 enable?
CVE-2024-5129 can enable unauthorized users to delete datasets, resulting in data loss.
Is there a patch available for CVE-2024-5129?
Yes, a patch for CVE-2024-5129 can be applied by updating to a version of Lunary that includes the fix.
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/softwarecombine
- agent/remedy
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/lunary
- canonical/lunary lunary