CVE-2024-6867 — MEDIUM (6.5)

Vulnerability Description

An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify that the user has the necessary access rights to the run(s) they are accessing. As a result, it returns not only the specified run but also all runs that have the `run_id` listed as their parent run. This issue affects the main branch, commit a761d833. The vulnerability allows unauthorized users to obtain information about non-public runs and their related runs, given the `run_id` of a public or non-public run.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Lunary	Lunary	1.4.9

Related Weaknesses (CWE)

CWE-1220

References

https://github.com/lunary-ai/lunary/commit/35afd4439464571eb016318cd7b6f85a16222Patch
https://huntr.com/bounties/460df515-164c-4435-954b-0233a181545fExploitThird Party Advisory

FAQ

What is CVE-2024-6867?

CVE-2024-6867 is a vulnerability with a CVSS score of 6.5 (MEDIUM). An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify that the user has the necessary access right...

How severe is CVE-2024-6867?

CVE-2024-6867 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-6867?

Check the references section above for vendor advisories and patch information. Affected products include: Lunary Lunary.