Vulnerability Details CVE-2024-5277
In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use. This allows an attacker who compromises the recovery token to repeatedly change the password of a victim's account. The issue lies in the backend's handling of the reset password process, where the token, once used, is not discarded or invalidated, enabling its reuse. This vulnerability could lead to unauthorized account access if an attacker obtains the recovery token.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 33.8%
CVSS Severity
CVSS v3 Score 6.4
References
Products affected by CVE-2024-5277
-
cpe:2.3:a:lunary:lunary:-
-
cpe:2.3:a:lunary:lunary:0.1.0
-
cpe:2.3:a:lunary:lunary:0.1.1
-
cpe:2.3:a:lunary:lunary:0.1.2
-
cpe:2.3:a:lunary:lunary:0.1.3
-
cpe:2.3:a:lunary:lunary:0.1.4
-
cpe:2.3:a:lunary:lunary:0.1.5
-
cpe:2.3:a:lunary:lunary:0.2.0
-
cpe:2.3:a:lunary:lunary:0.2.1
-
cpe:2.3:a:lunary:lunary:0.3.0
-
cpe:2.3:a:lunary:lunary:0.3.1
-
cpe:2.3:a:lunary:lunary:1.0.0
-
cpe:2.3:a:lunary:lunary:1.0.1
-
cpe:2.3:a:lunary:lunary:1.0.2
-
cpe:2.3:a:lunary:lunary:1.1.0
-
cpe:2.3:a:lunary:lunary:1.2.0
-
cpe:2.3:a:lunary:lunary:1.2.1
-
cpe:2.3:a:lunary:lunary:1.2.10
-
cpe:2.3:a:lunary:lunary:1.2.11
-
cpe:2.3:a:lunary:lunary:1.2.12
-
cpe:2.3:a:lunary:lunary:1.2.13
-
cpe:2.3:a:lunary:lunary:1.2.14
-
cpe:2.3:a:lunary:lunary:1.2.15
-
cpe:2.3:a:lunary:lunary:1.2.16
-
cpe:2.3:a:lunary:lunary:1.2.17
-
cpe:2.3:a:lunary:lunary:1.2.18
-
cpe:2.3:a:lunary:lunary:1.2.19
-
cpe:2.3:a:lunary:lunary:1.2.2
-
cpe:2.3:a:lunary:lunary:1.2.20
-
cpe:2.3:a:lunary:lunary:1.2.21
-
cpe:2.3:a:lunary:lunary:1.2.22
-
cpe:2.3:a:lunary:lunary:1.2.23
-
cpe:2.3:a:lunary:lunary:1.2.24
-
cpe:2.3:a:lunary:lunary:1.2.25
-
cpe:2.3:a:lunary:lunary:1.2.26
-
cpe:2.3:a:lunary:lunary:1.2.27
-
cpe:2.3:a:lunary:lunary:1.2.28
-
cpe:2.3:a:lunary:lunary:1.2.29
-
cpe:2.3:a:lunary:lunary:1.2.3
-
cpe:2.3:a:lunary:lunary:1.2.30
-
cpe:2.3:a:lunary:lunary:1.2.31
-
cpe:2.3:a:lunary:lunary:1.2.32
-
cpe:2.3:a:lunary:lunary:1.2.33
-
cpe:2.3:a:lunary:lunary:1.2.34
-
cpe:2.3:a:lunary:lunary:1.2.4
-
cpe:2.3:a:lunary:lunary:1.2.5
-
cpe:2.3:a:lunary:lunary:1.2.6
-
cpe:2.3:a:lunary:lunary:1.2.7
-
cpe:2.3:a:lunary:lunary:1.2.8
-
cpe:2.3:a:lunary:lunary:1.2.9
-
cpe:2.3:a:lunary:lunary:1.3.0
-
cpe:2.3:a:lunary:lunary:1.3.1
-
cpe:2.3:a:lunary:lunary:1.3.10
-
cpe:2.3:a:lunary:lunary:1.3.11
-
cpe:2.3:a:lunary:lunary:1.3.2
-
cpe:2.3:a:lunary:lunary:1.3.3
-
cpe:2.3:a:lunary:lunary:1.3.4
-
cpe:2.3:a:lunary:lunary:1.3.5
-
cpe:2.3:a:lunary:lunary:1.3.6
-
cpe:2.3:a:lunary:lunary:1.3.7
-
cpe:2.3:a:lunary:lunary:1.3.8
-
cpe:2.3:a:lunary:lunary:1.3.9
-
cpe:2.3:a:lunary:lunary:1.4.0
-
cpe:2.3:a:lunary:lunary:1.4.1
-
cpe:2.3:a:lunary:lunary:1.4.2
-
cpe:2.3:a:lunary:lunary:1.4.3
-
cpe:2.3:a:lunary:lunary:1.4.4
-
cpe:2.3:a:lunary:lunary:1.4.5
-
cpe:2.3:a:lunary:lunary:1.4.6
-
cpe:2.3:a:lunary:lunary:1.4.7
-
cpe:2.3:a:lunary:lunary:1.4.8