CVE-2024-3502 Exposure of Sensitive Information in lunary-ai/lunary
Authenticated users can access sensitive account recovery hashes via API endpoints, potentially enabling account takeover attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3502?
CVE-2024-3502 is a critical vulnerability in Lunary Lunary, published on 14 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently exposed to unauthorized actors. This issue occurs when authenticated users inspect responses from `GET /v1/users/me` and `GET /v1/users/me/org` endpoints. The exposed account recovery hashes, while not directly related to user passwords, represent sensitive information that should not be accessible to unauthorized parties. Exposing these hashes could potentially facilitate account recovery attacks or other malicious activities. The vulnerability was addressed in version 1.2.6.
Which versions are affected by CVE-2024-3502?
It affects 1 product.
Products include Lunary Lunary.
How do I fix CVE-2024-3502?
No fix has been published for CVE-2024-3502 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-3502 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-3502 exists.
Other vulnerabilities in Lunary Lunary
- CVE-2024-8999 Improper Access Control in lunary-ai/lunary
- CVE-2024-9095 Improper Authorization in lunary-ai/lunary
- CVE-2024-7456 SQL Injection in lunary-ai/lunary
- CVE-2024-4146 Incorrect Authorization in lunary-ai/lunary
- CVE-2024-5386 Account Hijacking via Password Reset Token Leak in lunary-ai/lunary
Sources
Also known as GHSA-cgjv-g7x3-8jrm.