Vulnerability Description
In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to the inclusion of single-use tokens in the responses of `GET /v1/users/me` and `GET /v1/users/me/org` API endpoints. These tokens, intended for sensitive operations such as password resets or account verification, are exposed to unauthorized actors, potentially allowing them to perform actions on behalf of the user. This issue was addressed in version 1.2.6, where the exposure of single-use tokens in user-facing queries was mitigated.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Lunary | Lunary | < 1.2.6 |
Related Weaknesses (CWE)
References
- https://github.com/lunary-ai/lunary/commit/17e95f6c99c7d5ac4ee5451c5857b97a12892Patch
- https://huntr.com/bounties/8fdfdb9d-10bd-4f00-8004-d5baabc20c6eIssue TrackingPatchThird Party Advisory
FAQ
What is CVE-2024-3501?
CVE-2024-3501 is a vulnerability with a CVSS score of 8.1 (HIGH). In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to the inclusion of single-use tokens in the responses of `GET /v1/users/me` and `GET /v1/use...
How severe is CVE-2024-3501?
CVE-2024-3501 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-3501?
Check the references section above for vendor advisories and patch information. Affected products include: Lunary Lunary.