CVE-2024-3501

Katalog CVE

CVSS 8.1 · High EPSS 0,41%

Kerentanan Insecure Storage of Sensitive Information pada lunary. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to the inclusion of single-use tokens in the responses of `GET /v1/users/me` and `GET /v1/users/me/org` API endpoints. These tokens, intended for sensitive operations such as password resets or account verification, are exposed to unauthorized actors, potentially allowing them to perform actions on behalf of the user. This issue was addressed in version 1.2.6, where the exposure of single-use tokens in user-facing queries was mitigated.

Rincian

Terbit di NVD

14 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-922: Insecure Storage of Sensitive Information

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lunary-ai/lunary/commit/17e95f6c99c7d5ac4ee5451c5857b97a12892c74 patch
• https://huntr.com/bounties/8fdfdb9d-10bd-4f00-8004-d5baabc20c6e issue tracking · patch · advisory pihak ketiga