CVE-2024-4151
Assigner: @huntr_ai
Published: 2024-05-20T14:14:53.399Z
State: PUBLISHED
title: Improper Access Control in lunary-ai/lunary
descriptions: value: An Improper Access Control vulnerability exists in lunary-ai/lunary version 1.2.2, where users can view and update any prompts in any projects due to insufficient access control checks in the handling of PATCH and GET requests for template versions. This vulnerability allows unauthorized users to manipulate or access sensitive project data, potentially leading to data integrity and confidentiality issues.
affected: vendor: lunary-ai
product: lunary-ai/lunary
versions: version: unspecified
status: affected
versionType: custom
lessThanOrEqual: latest
metrics: cvssV3_0: version: 3.0
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
baseScore: 8.3
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-284 Improper Access Control
cweId: CWE-284
source: advisory: 4acfef85-dedf-43bd-8438-0d8aaa4ffa01
discovery: EXTERNAL