← Zuruck zu CVEs
CVE-2024-1741
CRITICAL9.1
Beschreibung
lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by sending HTTP requests with their previously captured authorization token. This issue exposes organizations to unauthorized access and manipulation of sensitive template data.
CVE Details
CVSS v3.1 Bewertung9.1
SchweregradCRITICAL
CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
AngriffsvektorNETWORK
KomplexitatLOW
Erforderliche PrivilegienNONE
BenutzerinteraktionNONE
Veroffentlicht4/10/2024
Zuletzt geandert1/31/2025
Quellenvd
Honeypot-Sichtungen0
Betroffene Produkte
lunary:lunary
Schwachen (CWE)
CWE-863CWE-863
Referenzen
https://github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2(security@huntr.dev)
https://huntr.com/bounties/671bd040-1cc5-4227-8182-5904e9c5ed3b(security@huntr.dev)
https://github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2(af854a3a-2127-422b-91ae-364da2661108)
https://huntr.com/bounties/671bd040-1cc5-4227-8182-5904e9c5ed3b(af854a3a-2127-422b-91ae-364da2661108)
IOC Korrelationen
Keine Korrelationen erfasst
This product uses data from the NVD API but is not endorsed or certified by the NVD.