In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using an old authorization token. The lunary web application communicates with the server using an 'Authorization' token in the browser, which does not properly invalidate upon the user's removal from the organization. This allows the removed user to perform unauthorized actions on logs and access project and external user details without valid permissions.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Lunary |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-17467 | In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using an old authorization token. The lunary web application communicates with the server using an 'Authorization' token in the browser, which does not properly invalidate upon the user's removal from the organization. This allows the removed user to perform unauthorized actions on logs and access project and external user details without valid permissions. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 10 Jan 2025 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lunary
Lunary lunary |
|
| CPEs | cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Lunary
Lunary lunary |
|
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2024-08-01T18:48:21.987Z
Reserved: 2024-02-22T11:42:03.637Z
Link: CVE-2024-1740
Vulnrichment
Updated: 2024-08-01T18:48:21.987Z
NVD
Status : Analyzed
Published: 2024-04-10T17:15:53.293
Modified: 2025-01-10T14:21:52.317
Link: CVE-2024-1740
Redhat
No data.
OpenCVE Enrichment
No data.