Back

CVE-2024-5277

June 6, 2024, 6:15 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Lunary

  • 1.2.4

Source

security@huntr.dev

Tags

CWE-640
security@huntr.dev
2024-06-06
CVE-2024-5277

CVE-2024-5277 details

Published : June 6, 2024, 6:15 p.m.
Last Modified : June 6, 2024, 6:15 p.m.

Description

In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use. This allows an attacker who compromises the recovery token to repeatedly change the password of a victim's account. The issue lies in the backend's handling of the reset password process, where the token, once used, is not discarded or invalidated, enabling its reuse. This vulnerability could lead to unauthorized account access if an attacker obtains the recovery token.

CVSS Score

1 2 3 4 5 6.4 7 8 9 10

Weakness

Weakness Name Description

CVSS Data

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

6.4

Exploitability Score

Impact Score

Base Severity

MEDIUM

Vector String : CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

References

URL Source
https://huntr.com/bounties/6aaba769-d99c-48cf-90d2-7abad984213d security@huntr.dev
This website uses the NVD API, but is not approved or certified by it.