CVE-2024-1902
Assigner: @huntr_ai
Published: 2024-04-10T17:08:05.267Z
State: PUBLISHED
title: Session Reuse Vulnerability in lunary-ai/lunary
descriptions: value: lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker can exploit this by using an old authorization token to send a PATCH request, modifying the organization's name even after being removed from the organization. This issue is due to incorrect synchronization and affects the orgs.patch route.
affected: vendor: lunary-ai
product: lunary-ai/lunary
versions: version: unspecified
lessThan: 1.2.8
status: affected
versionType: custom
metrics: cvssV3_0: version: 3.0
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
baseScore: 7.5
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-821 Incorrect Synchronization
cweId: CWE-821
source: advisory: e536310e-abe7-4585-9cf6-21f77390a5e8
discovery: EXTERNAL