Detections
Analytics

SCA: security update for lunary (GHSA-3mwc-2cj7-gx8c)

medium Tenable Cloud Security Plugin ID 421374

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows
 users to create, update, get, and delete prompt variations for datasets not owned by their organization.
 This issue arises due to the application not properly validating the ownership of dataset prompts and
 their variations against the organization or project of the requesting user. As a result, unauthorized
 modifications to dataset prompts can occur, leading to altered or removed dataset prompts without proper
 authorization. This vulnerability impacts the integrity and consistency of dataset information,
 potentially affecting the results of experiments. (CVE-2024-5389)

See Also

https://github.com/advisories/GHSA-3mwc-2cj7-gx8c

Plugin Details

Severity: Medium

ID: 421374

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 3/28/2025

Updated: 6/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.37

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2024-5389

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.4

Threat Score: 5.4

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/10/2024

Vulnerability Publication Date: 6/9/2024

Reference Information

CVE: CVE-2024-5389