CVE-2024-3502

Katalog CVE

CVSS 8.1 · High EPSS 0,41%

Kerentanan Insertion of Sensitive Information Into Sent Data pada lunary. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently exposed to unauthorized actors. This issue occurs when authenticated users inspect responses from `GET /v1/users/me` and `GET /v1/users/me/org` endpoints. The exposed account recovery hashes, while not directly related to user passwords, represent sensitive information that should not be accessible to unauthorized parties. Exposing these hashes could potentially facilitate account recovery attacks or other malicious activities. The vulnerability was addressed in version 1.2.6.

Rincian

Terbit di NVD

14 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-201: Insertion of Sensitive Information Into Sent Data
CWE-922: Insecure Storage of Sensitive Information

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lunary-ai/lunary/commit/17e95f6c99c7d5ac4ee5451c5857b97a12892c74 patch
• https://huntr.com/bounties/c2aff952-2dec-4538-8905-190c484aae94 issue tracking · patch · advisory pihak ketiga