2 lines
2.5 KiB
JSON
2 lines
2.5 KiB
JSON
{"affected":[{"affectedData":[{"product":"lunary-ai/lunary","vendor":"lunary-ai","versions":[{"lessThan":"1.9.23","status":"affected","version":"unspecified","versionType":"custom"}]}],"source":"security@huntr.dev"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An Insecure Direct Object Reference (IDOR) vulnerability was identified in the `POST /v1/templates` endpoint of the Lunary API, affecting versions up to 0.8.8. This vulnerability allows authenticated users to create templates in another user's project by altering the `projectId` query parameter. The root cause of this issue is the absence of server-side validation to ensure that the authenticated user owns the specified `projectId`. The vulnerability has been addressed in version 1.9.23."},{"lang":"es","value":"Se identificó una vulnerabilidad de Referencia Directa a Objetos Insegura (IDOR) en el endpoint `POST /v1/templates` de la API de Lunary, que afecta a versiones hasta la 0.8.8. Esta vulnerabilidad permite a usuarios autenticados crear plantillas en el proyecto de otro usuario modificando el parámetro de consulta `projectId`. La causa principal de este problema es la ausencia de validación del lado del servidor para garantizar que el usuario autenticado posea el `projectId` especificado. Esta vulnerabilidad se ha solucionado en la versión 1.9.23."}],"id":"CVE-2025-4962","lastModified":"2026-06-17T09:34:23.937","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","version":"3.0"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"security@huntr.dev","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-4962","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-08-18T14:00:34.991769Z","version":"2.0.3"}}]},"published":"2025-08-18T14:15:30.050","references":[{"source":"security@huntr.dev","url":"https://github.com/lunary-ai/lunary/commit/e977d06f18a615963ffbe07e5bdff70218c29907"},{"source":"security@huntr.dev","url":"https://huntr.com/bounties/137a0aef-e243-49d4-832f-8e56056cba1a"}],"sourceIdentifier":"security@huntr.dev","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security@huntr.dev","type":"Secondary"}]}
|