CVE-2024-3502
Last modified
CVE-2024-3502 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently exposed to unauthorized actors. This issue occurs when authenticated users inspect responses from `GET /v1/users/me` and `GET /v1/users/me/org` endpoints. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently exposed to unauthorized actors. This issue occurs when authenticated users inspect responses from `GET /v1/users/me` and `GET /v1/users/me/org` endpoints. The exposed account recovery hashes, while not directly related to user passwords, represent sensitive information that should not be accessible to unauthorized parties. Exposing these hashes could potentially facilitate account recovery attacks or other malicious activities. The vulnerability was addressed in version 1.2.6.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Lunary | Lunary | < 1.2.6 |
References
- https://huntr.com/bounties/c2aff952-2dec-4538-8905-190c484aae94Issue Tracking, Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-3502?
How severe is CVE-2024-3502?
How do I fix CVE-2024-3502?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-3500The ElementsKit Pro plugin for WordPress is vulnerable to Lo…8.8
- CVE-2024-35009idccms v1.35 was discovered to contain a Cross-Site Request …8.8
- CVE-2024-3501In lunary-ai/lunary versions up to and including 1.2.5, an i…8.1
- CVE-2024-35010idccms v1.35 was discovered to contain a Cross-Site Request …8.8
- CVE-2024-35011idccms v1.35 was discovered to contain a Cross-Site Request …5.4
- CVE-2024-35012idccms v1.35 was discovered to contain a Cross-Site Request …6.3
- CVE-2024-35039idccms V1.35 was discovered to contain a Cross-Site Request …3.8
- CVE-2024-3504An improper access control vulnerability exists in lunary-ai…6.5
- CVE-2024-35048An issue in SurveyKing v1.3.1 allows attackers to execute a …4.3
- CVE-2024-35049SurveyKing v1.3.1 was discovered to keep users' sessions act…9.1
- CVE-2024-3505JFrog Artifactory Self-Hosted versions below 7.77.3, are vul…4.3
- CVE-2024-35050An issue in SurveyKing v1.3.1 allows attackers to escalate p…8.8
Are you affected by CVE-2024-3502?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST