Description
An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify that the user has the necessary access rights to the run(s) they are accessing. As a result, it returns not only the specified run but also all runs that have the `run_id` listed as their parent run. This issue affects the main branch, commit a761d833. The vulnerability allows unauthorized users to obtain information about non-public runs and their related runs, given the `run_id` of a public or non-public run.
Published: 2024-09-13
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-2763 An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify that the user has the necessary access rights to the run(s) they are accessing. As a result, it returns not only the specified run but also all runs that have the `run_id` listed as their parent run. This issue affects the main branch, commit a761d833. The vulnerability allows unauthorized users to obtain information about non-public runs and their related runs, given the `run_id` of a public or non-public run.
Github GHSA Github GHSA GHSA-9jmp-j63g-8x6m Withdrawn Advisory: Lunary information disclosure vulnerability
History

Thu, 19 Sep 2024 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Lunary
Lunary lunary
CPEs cpe:2.3:a:lunary:lunary:1.4.9:*:*:*:*:*:*:*
Vendors & Products Lunary
Lunary lunary
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Fri, 13 Sep 2024 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Lunary-ai
Lunary-ai lunary-ai\/lunary
CPEs cpe:2.3:a:lunary-ai:lunary-ai\/lunary:*:*:*:*:*:*:*:*
Vendors & Products Lunary-ai
Lunary-ai lunary-ai\/lunary
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 13 Sep 2024 16:30:00 +0000

Type Values Removed Values Added
Description An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify that the user has the necessary access rights to the run(s) they are accessing. As a result, it returns not only the specified run but also all runs that have the `run_id` listed as their parent run. This issue affects the main branch, commit a761d833. The vulnerability allows unauthorized users to obtain information about non-public runs and their related runs, given the `run_id` of a public or non-public run.
Title Information Disclosure in lunary-ai/lunary
Weaknesses CWE-1220
References
Metrics cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Lunary Lunary
Lunary-ai Lunary-ai\/lunary
cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published:

Updated: 2024-09-13T16:38:51.331Z

Reserved: 2024-07-17T21:16:51.698Z

Link: CVE-2024-6867

cve-icon Vulnrichment

Updated: 2024-09-13T16:38:44.228Z

cve-icon NVD

Status : Analyzed

Published: 2024-09-13T17:15:13.613

Modified: 2024-09-19T18:28:05.477

Link: CVE-2024-6867

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses