Access Control Vulnerability in Lunary AI affecting Evaluators Endpoint

CVE-2024-10330

What is CVE-2024-10330?

In Lunary AI version 1.5.6, a vulnerability exists in the /v1/evaluators/ endpoint due to insufficient access controls. This allows any user associated with a project to retrieve all evaluator data, irrespective of their access privileges. Consequently, users with minimal permissions could potentially view sensitive evaluation information, posing a significant risk to data confidentiality.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References