CVE-2024-4153

May 22, 2024, 12:46 p.m.

4.3
Medium

Description

A vulnerability in lunary-ai/lunary version 1.2.2 allows attackers to bypass user creation limits and potentially evade payment requirements. The issue arises from an undefined behavior when handling input to the API, specifically through a POST request to the /v1/users endpoint. By crafting a request with a new user's email and assigning them an 'admin' role, attackers can invite additional users beyond the set limit. This vulnerability could be exploited to add an unlimited number of users without adhering to the intended restrictions.

Product(s) Impacted

Product Versions
lunary-ai/lunary
  • 1.2.2

Weaknesses

Common security weaknesses mapped to this vulnerability.

References

https://huntr.com/bounties/336db0ae-fe33-44b9-ba9d-bf117e0d90c4

Tags

security@huntr.dev
2024-05-22
CVE-2024-4153
CWE-475

CVSS Score

4.3 / 10

CVSS Data - 3.0

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: LOW
  • Integrity Impact: NONE
  • Availability Impact: NONE

    • CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

    View Vector String

Timeline

Published: May 22, 2024, 10:15 a.m.
Last Modified: May 22, 2024, 12:46 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@huntr.dev

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.