CVE-2024-5714

{"id": "CVE-2024-5714", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "published": "2024-06-27T19:15:15.930", "references": [{"url": "https://huntr.com/bounties/8cff4afa-131b-4a7e-9f0d-8a3c69f3d024", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissions to manipulate project identifiers in requests, enabling them to invite users to projects in other organizations, change members to projects in other organizations with escalated privileges, and change members from other organizations to their own or other projects, also with escalated privileges. This vulnerability is due to the backend's failure to validate project identifiers against the current user's organization ID and projects belonging to it, as well as a misconfiguration in attribute naming (`org_id` should be `orgId`) that prevents proper user organization validation. As a result, attackers can cause inconsistencies on the platform for affected users and organizations, including unauthorized privilege escalation. The issue is present in the backend API endpoints for user invitation and modification, specifically in the handling of project IDs in requests."}, {"lang": "es", "value": "En lunary-ai/lunary versi\u00f3n 1.2.4, una vulnerabilidad de control de acceso inadecuado permite a los miembros con permisos de administraci\u00f3n de equipos manipular identificadores de proyectos en solicitudes, permiti\u00e9ndoles invitar a usuarios a proyectos en otras organizaciones, cambiar miembros a proyectos en otras organizaciones con privilegios escalados. y cambiar miembros de otras organizaciones a proyectos propios o de otros, tambi\u00e9n con privilegios aumentados. Esta vulnerabilidad se debe a que el backend no valida los identificadores de proyecto con el ID de la organizaci\u00f3n del usuario actual y los proyectos que le pertenecen, as\u00ed como a una mala configuraci\u00f3n en la denominaci\u00f3n de atributos (\"org_id\" debe ser \"orgId\") que impide la validaci\u00f3n adecuada de la organizaci\u00f3n del usuario. Como resultado, los atacantes pueden provocar inconsistencias en la plataforma para los usuarios y organizaciones afectados, incluida una escalada de privilegios no autorizada. El problema est\u00e1 presente en los endpoints de la API backend para la invitaci\u00f3n y modificaci\u00f3n de usuarios, espec\u00edficamente en el manejo de ID de proyecto en solicitudes."}], "lastModified": "2024-09-19T15:52:36.663", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lunary:lunary:1.2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEE22CCF-D0D5-46A4-BDE3-A30FB14F094A"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}