CVE-2024-7474 | THREATINT

Description

In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists. A user can view or delete external users by manipulating the 'id' parameter in the request URL. The application does not perform adequate checks on the 'id' parameter, allowing unauthorized access to external user data.

Reserved 2024-08-04 | Published 2024-10-29 | Updated 2024-11-14 | Assigner @huntr_ai

CRITICAL: 9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Any version before 1.3.4

affected

References

huntr.com/bounties/95d8b993-3347-4ef5-a2b3-1f57219b7871

github.com/...ommit/8f563c77d8614a72980113f530c7a9ec15a5f8d5

cve.org (CVE-2024-7474)

nvd.nist.gov (CVE-2024-7474)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.