CVE-2024-1666

Katalog CVE

CVSS 5.3 · Medium EPSS 0,46%

Kerentanan Allocation of Resources Without Limits or Throttling pada lunary. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side checks to verify if a user is on a free account during the radar creation process, which is only enforced in the web UI. As a result, attackers can bypass the intended account upgrade requirement by directly sending crafted requests to the server, enabling the creation of an unlimited number of radars without payment.

Rincian

Terbit di NVD

16 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54 exploit · issue tracking · patch · advisory pihak ketiga
• https://huntr.com/bounties/0f310501-b5b0-4be0-ae38-d6b836f71ff0 exploit · issue tracking · patch · advisory pihak ketiga