PT-2025-12267 · Lunary · Lunary

Publicado 2025-03-20 · Atualizado 2025-03-21 · CVE-2024-9098

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions prior to 1.4.30

Description The issue arises from the user creation endpoint not restricting administrators from inviting users with billing roles, allowing them to gain unauthorized access to billing resources. This poses a risk to the organization's financial resources as administrators can circumvent the intended access control.

Recommendations For versions prior to 1.4.30, update to version 1.4.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the user creation endpoint to prevent administrators from inviting users with billing roles.

Exploit

Correção

LPE

Improper Access Control

Incorrect Authorization

Enumeração de Fraquezas

CWE-284

CWE-863

Identificadores relacionados

CVE-2024-9098

Produtos afetados

Lunary

Referências · 5

• 🔥 https://huntr.com/bounties/75d466ae-8591-44d5-9160-eea7cad0c4fc · Exploit
• https://github.com/lunary-ai/lunary/commit/a8d7b2959e87c30fbafdb12af7ffa093385dcc60 · Correção
• https://osv.dev/vulnerability/CVE-2024-9098 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1902968882815701056 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-9098 · Nota de Segurança