CVE-2024-7474 Vulnerability Details

  /     /     /  

CVE-2024-7474 Metadata Quick Info

CVE Published: 29/10/2024 | CVE Updated: 14/11/2024 | CVE Year: 2024
Source: @huntr_ai | Vendor: lunary-ai | Product: lunary-ai/lunary
Status : PUBLISHED

---

CVE-2024-7474 Description

In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists. A user can view or delete external users by manipulating the \'id\' parameter in the request URL. The application does not perform adequate checks on the \'id\' parameter, allowing unauthorized access to external user data.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-639
CWE Name: CWE-639 Authorization Bypass Through User-Controlled Key
Source: lunary-ai

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).