CVE-2024-7474CWE-639

IDOR in lunary-ai/lunary

Critical · published October 29, 2024

CVSS v3.0
9.1
EPSS
1%
Percentile
45.7
In the wild
Unconfirmed
What it is

In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists. A user can view or delete external users by manipulating the 'id' parameter in the request URL. The application does not perform adequate checks on the 'id' parameter, allowing unauthorized access to external user data.

The record
Technical detail
CVSS v3.0
9.1 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00558 · 45.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2024-10-29T12:46Z
EPSS history
Timeline
  • 29 OCT 12:46Z
    IDOR in lunary-ai/lunary
    cvelistv5