CVE-2024-5133: Account Takeover via Exposed Recovery Token in lunary-ai/lunary
First published: Thu Jun 06 2024(Updated: )
In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, when a user initiates the password reset process, the recovery token is included in the response of the `GET /v1/users/me/org` endpoint, which lists all users in a team. This allows any authenticated user to capture the recovery token of another user and subsequently change that user's password without consent, effectively taking over the account. The issue lies in the inclusion of the `recovery_token` attribute in the users object returned by the API.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| lunary lunary | <1.2.14 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-5133?
CVE-2024-5133 is classified as a high severity vulnerability due to its potential for account takeover.
How do I fix CVE-2024-5133?
To fix CVE-2024-5133, update to lunary version 1.2.14 or later where the vulnerability has been addressed.
What causes CVE-2024-5133?
CVE-2024-5133 is caused by the exposure of password recovery tokens in API responses during the password reset process.
Who is affected by CVE-2024-5133?
Users of lunary-ai/lunary versions prior to 1.2.14 are affected by CVE-2024-5133.
What can attackers do with CVE-2024-5133?
Attackers can exploit CVE-2024-5133 to perform unauthorized account takeovers by accessing exposed recovery tokens.
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/softwarecombine
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/lunary
- canonical/lunary lunary