PT-2024-26289 · Lunary Ai · Lunary

Published 2024-11-14 · Updated 2025-01-30 · CVE-2024-3501

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions up to and including 1.2.5

Description An information disclosure issue exists due to the inclusion of single-use tokens in the responses of GET /v1/users/me and GET /v1/users/me/org API endpoints. These tokens, intended for sensitive operations such as password resets or account verification, are exposed to unauthorized actors, potentially allowing them to perform actions on behalf of the user.

Recommendations For lunary-ai/lunary versions up to and including 1.2.5, update to version 1.2.6 to mitigate the exposure of single-use tokens in user-facing queries. As a temporary workaround, consider restricting access to the GET /v1/users/me and GET /v1/users/me/org API endpoints until the update is applied.

Fix

Information Disclosure

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-922

Related Identifiers

CVE-2024-3501

Affected Products

Lunary

References · 8

• https://github.com/lunary-ai/lunary/commit/17e95f6c99c7d5ac4ee5451c5857b97a12892c74 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-3501 · Security Note
• https://huntr.com/bounties/8fdfdb9d-10bd-4f00-8004-d5baabc20c6e · Patch
• https://osv.dev/vulnerability/CVE-2024-3501 · Vendor Advisory
• https://twitter.com/CVEnew/status/1857119164860641725 · Twitter Post
• https://t.me/cvenotify/109147 · Telegram Post
• https://t.me/cvenotify/102060 · Telegram Post
• https://twitter.com/CveFindCom/status/1857121973429494212 · Twitter Post