CVE-2024-1665

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1665
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVSS

No CVSS.

References

No reference.

Configurations

No configuration.

History

07 Jun 2024, 17:15

Type Values Removed Values Added
References
  • {'url': 'https://github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54', 'source': 'security@huntr.dev'}
  • {'url': 'https://huntr.com/bounties/c0e6299e-ea45-435c-b849-53d50ffc0e83', 'source': 'security@huntr.dev'}
CWE CWE-770
CVSS v2 : unknown
v3 : 5.3 		v2 : unknown
v3 : unknown
Summary
  • (es) lunary-ai/lunary versión 1.0.0 es vulnerable a la creación de evaluaciones no autorizadas debido a que faltan verificaciones del lado del servidor para el estado de la cuenta de usuario durante la creación de la evaluación. Si bien la interfaz de usuario web restringe la creación de evaluaciones a cuentas pagas, el endpoint API del lado del servidor '/v1/evaluations' no verifica si el usuario tiene una cuenta paga, lo que permite a los usuarios con cuentas gratuitas o autohospedadas crear evaluaciones ilimitadas sin actualizar su cuenta. Esta vulnerabilidad se debe a la falta de validación del estado de la cuenta en el proceso de creación de la evaluación.
Summary (en) lunary-ai/lunary version 1.0.0 is vulnerable to unauthorized evaluation creation due to missing server-side checks for user account status during evaluation creation. While the web UI restricts evaluation creation to paid accounts, the server-side API endpoint '/v1/evaluations' does not verify if the user has a paid account, allowing users with free or self-hosted accounts to create unlimited evaluations without upgrading their account. This vulnerability is due to the lack of account status validation in the evaluation creation process. (en) Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

16 Apr 2024, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-16 00:15

Updated : 2024-06-07 17:15

NVD link : CVE-2024-1665

Mitre link : CVE-2024-1665

CVE.ORG link : CVE-2024-1665

JSON object : View

Products Affected

No product.

CWE

No CWE.