Lucene search

@huntr_aiCVE-2024-4148

HistoryJun 01, 2024 - 4:15 p.m.

CVE-2024-4148

2024-06-0116:15:07

CWE-400

@huntr_ai

web.nvd.nist.gov

cve-2024-4148

vulnerability

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.1

Confidence

High

EPSS

Percentile

9.0%

JSON

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary application, version 1.2.10. An attacker can exploit this vulnerability by maliciously manipulating regular expressions, which can significantly impact the response time of the application and potentially render it completely non-functional. Specifically, the vulnerability can be triggered by sending a specially crafted request to the application, leading to a denial of service where the application crashes.

Affected configurations

Vulnrichment

Node

lunary-ailunaryMatch1.2.10

VendorProductVersionCPE
lunary-ailunary1.2.10cpe:2.3:a:lunary-ai:lunary:1.2.10:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lunary-ai	lunary	1.2.10	cpe:2.3:a:lunary-ai:lunary:1.2.10:::::::*

CNA Affected

[
  {
    "vendor": "lunary-ai",
    "product": "lunary-ai/lunary",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

References

huntr.com/bounties/eca4ad45-2a38-4f3c-9ec1-8205cd51be31

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.1

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-4148