CVE-2024-5128

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-5128
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5128.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-5128
Published
2024-06-06T19:16:04Z
Modified
2024-06-08T01:19:09.543019Z
Summary
[none]
Details

An Insecure Direct Object Reference (IDOR) vulnerability was identified in lunary-ai/lunary, affecting versions up to and including 1.2.2. This vulnerability allows unauthorized users to view, update, or delete any datasetprompt or datasetprompt_variation within any dataset or project. The issue stems from improper access control checks in the dataset management endpoints, where direct references to object IDs are not adequately secured against unauthorized access. This vulnerability was fixed in version 1.2.25.

References

Affected packages

Git / github.com/lunary-ai/lunary

Affected ranges

Type
GIT
Repo
https://github.com/lunary-ai/lunary
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

1.*

1.2.4

Other

test1
test2
vtest

v0.*

v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.2.0
v0.2.1
v0.3.0
v0.3.1

v1.*

v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.2.0
v1.2.1
v1.2.10
v1.2.11
v1.2.12
v1.2.13
v1.2.14
v1.2.15
v1.2.16
v1.2.17
v1.2.18
v1.2.19
v1.2.2
v1.2.20
v1.2.21
v1.2.22
v1.2.23
v1.2.24
v1.2.3
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9