CVE-2024-3501: Exposure of Sensitive Information in lunary-ai/lunary
First published: Thu Nov 14 2024(Updated: )
In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to the inclusion of single-use tokens in the responses of `GET /v1/users/me` and `GET /v1/users/me/org` API endpoints. These tokens, intended for sensitive operations such as password resets or account verification, are exposed to unauthorized actors, potentially allowing them to perform actions on behalf of the user. This issue was addressed in version 1.2.6, where the exposure of single-use tokens in user-facing queries was mitigated.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| lunary lunary | <1.2.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-3501?
CVE-2024-3501 is classified as a medium severity information disclosure vulnerability.
How do I fix CVE-2024-3501?
To fix CVE-2024-3501, upgrade to lunary version 1.2.6 or later.
Which API endpoints are affected by CVE-2024-3501?
The API endpoints affected by CVE-2024-3501 are `GET /v1/users/me` and `GET /v1/users/me/org`.
What type of vulnerability is CVE-2024-3501?
CVE-2024-3501 is an information disclosure vulnerability.
What versions of lunary are vulnerable to CVE-2024-3501?
Lunary versions up to and including 1.2.5 are vulnerable to CVE-2024-3501.
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- agent/remedy
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/source
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- vendor/lunary