CVE-2024-1740: Incorrect Authorization in lunary-ai/lunary
First published: Wed Apr 10 2024(Updated: )
In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using an old authorization token. The lunary web application communicates with the server using an 'Authorization' token in the browser, which does not properly invalidate upon the user's removal from the organization. This allows the removed user to perform unauthorized actions on logs and access project and external user details without valid permissions.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| lunary lunary | <1.2.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-1740?
CVE-2024-1740 has a high severity due to the potential for unauthorized access to sensitive log data.
How do I fix CVE-2024-1740?
To fix CVE-2024-1740, ensure that your application is updated to lunary version 1.2.7 or later.
Who is affected by CVE-2024-1740?
Users of lunary version 1.0.1 who have been removed from an organization are affected by CVE-2024-1740.
What are the impacts of CVE-2024-1740?
The impact of CVE-2024-1740 includes unauthorized users being able to read, create, modify, and delete logs.
When was CVE-2024-1740 disclosed?
CVE-2024-1740 was disclosed with an emphasis on the vulnerabilities present in lunary version 1.0.1.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/lunary
- canonical/lunary lunary