CVE-2024-5386

{"id": "CVE-2024-5386", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-5386", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-02-02T17:46:01.274264Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 3.1}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@huntr.dev", "affectedData": [{"vendor": "lunary-ai", "product": "lunary-ai/lunary", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "1.2.14", "versionType": "custom"}]}]}], "published": "2026-02-02T11:16:16.590", "references": [{"url": "https://github.com/lunary-ai/lunary/commit/fc7ab3d5621c18992da5dab3a2a9a8d227d42311", "tags": ["Broken Link"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/602eb4a1-305d-46d6-b975-5a5d8b040ad1", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-1125"}]}], "descriptions": [{"lang": "en", "value": "In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role can exploit this vulnerability to hijack another user's account by obtaining the password reset token. The vulnerability is triggered when the 'viewer' role user sends a specific request to the server, which responds with a password reset token in the 'recoveryToken' parameter. This token can then be used to reset the password of another user's account without authorization. The issue results from an excessive attack surface, allowing lower-privileged users to escalate their privileges and take over accounts."}, {"lang": "es", "value": "En lunary-ai/lunary versi\u00f3n 1.2.2, existe una vulnerabilidad de secuestro de cuentas debido a una fuga de token de restablecimiento de contrase\u00f1a. Un usuario con rol de 'viewer' puede explotar esta vulnerabilidad para secuestrar la cuenta de otro usuario al obtener el token de restablecimiento de contrase\u00f1a. La vulnerabilidad se activa cuando el usuario con rol de 'viewer' env\u00eda una solicitud espec\u00edfica al servidor, que responde con un token de restablecimiento de contrase\u00f1a en el par\u00e1metro 'recoveryToken'. Este token puede entonces ser utilizado para restablecer la contrase\u00f1a de la cuenta de otro usuario sin autorizaci\u00f3n. El problema se debe a una superficie de ataque excesiva, permitiendo a usuarios con privilegios inferiores escalar sus privilegios y tomar el control de cuentas."}], "lastModified": "2026-06-17T08:15:50.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EBE68D2-D623-498C-B3E2-44FD5E213CA2", "versionEndExcluding": "1.2.14"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}