CVE-2024-9000
CVSS 3.0 Score 7.1 of 10 (high)
Details
Published Mar 20, 2025
CWE ID 285
Summary
CVE-2024-9000 is a vulnerability affecting the lunary-ai/lunary package before version 1.4.26. This issue permits unauthorized users to create or modify checklists through the checklists.post() endpoint without proper permission checks. Moreover, the endpoint fails to validate the uniqueness of the slug field, enabling attackers to spoof existing checklists and potentially replace legitimate ones with malicious or altered data. These access control and data integrity issues can have significant consequences.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.