CVE-2024-1902

Katalog CVE

CVSS 7.5 · High EPSS 0,39%

Kerentanan Incorrect Synchronization pada lunary. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker can exploit this by using an old authorization token to send a PATCH request, modifying the organization's name even after being removed from the organization. This issue is due to incorrect synchronization and affects the orgs.patch route.

Rincian

Terbit di NVD

10 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-821: Incorrect Synchronization

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2 patch
• https://huntr.com/bounties/e536310e-abe7-4585-9cf6-21f77390a5e8 exploit · issue tracking · patch · advisory pihak ketiga