Data Integrity Vulnerability in Lunary AI by Lunary Technologies

CVE-2024-11301

What is CVE-2024-11301?

Lunary AI versions before 1.6.3 are vulnerable due to the absence of a unique constraint on the combination of projectId and slug, allowing attackers to overwrite existing evaluators. By sending a POST request with a slug that matches an existing evaluator, an attacker can compromise the application's data integrity, leading to potential data corruption and unwanted changes that affect the system's overall functionality.

References