CVE Feed

    Dashboard / CVE / CVE-2024-7474

    CVE-2024-7474

    In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists. A user can view or delete external users by manipulating the 'id' parameter in the request URL. The application does not perform adequate checks on the 'id' parameter, allowing unauthorized access to external user data.

    Published:Oct 29, 2024
    Last Modified:Jan 9, 2025
    EPS:Oct 29, 2024
    EPSS Score:0.00164
    CVSS Score:8.1

    Affected Products

    Vendor
    Lunary
    Product
    Lunary
    Vendor
    Lunary-ai
    Product
    Lunary

    Exploits

    https://huntr.com/bounties/95d8b993-3347-4ef5-a2b3-1f57219b7871

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-5386 (CVSS 8.8) — In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token lea…
    CVE-2024-4147 (CVSS 6.5) — In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users t…
    CVE-2025-9803 (CVSS 8.8) — lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Goo…
    CVE-2025-5352 (CVSS 9.6) — A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/luna…
    CVE-2025-4779 (CVSS 6.1) — lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthentica…
    CVE-2024-11300 (CVSS 6.5) — In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can acc…
    CVE-2024-10272 (CVSS 7.5) — lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the conten…
    CVE-2024-8998 (CVSS 7.5) — A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845. T…
    CVE-2025-0281 (CVSS 5.4) — A stored cross-site scripting (XSS) vulnerability exists in lunary-ai/lunary versions 1.6.7 and earlier. An at…
    CVE-2024-9099 (CVSS 8.1) — In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys f…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High