CVE-2024-5128
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-5128
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5128.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-5128
- Published
- 2024-06-06T19:16:04Z
- Modified
- 2025-07-02T00:30:30.705076Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
An Insecure Direct Object Reference (IDOR) vulnerability was identified in lunary-ai/lunary, affecting versions up to and including 1.2.2. This vulnerability allows unauthorized users to view, update, or delete any datasetprompt or datasetprompt_variation within any dataset or project. The issue stems from improper access control checks in the dataset management endpoints, where direct references to object IDs are not adequately secured against unauthorized access. This vulnerability was fixed in version 1.2.25.
- References
Affected packages
Git / github.com/lunary-ai/lunary
Affected ranges
- Type
- GIT
- Repo
- https://github.com/lunary-ai/lunary
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
1.*
1.2.4
Other
test1
test2
vtest
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.2.0
v0.2.1
v0.3.0
v0.3.1
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.2.0
v1.2.1
v1.2.10
v1.2.11
v1.2.12
v1.2.13
v1.2.14
v1.2.15
v1.2.16
v1.2.17
v1.2.18
v1.2.19
v1.2.2
v1.2.20
v1.2.21
v1.2.22
v1.2.23
v1.2.24
v1.2.3
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9