CVE-2024-8789— Lunary 资源管理错误漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2024-8789の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary
ソース: NVD (National Vulnerability Database)
脆弱性説明
Lunary-ai/lunary version git 105a3f6 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. The application allows users to upload their own regular expressions, which are then executed on the server side. Certain regular expressions can have exponential runtime complexity relative to the input size, leading to potential denial of service. An attacker can exploit this by submitting a specially crafted regular expression, causing the server to become unresponsive for an arbitrary length of time.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
CWE-1333
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Lunary 资源管理错误漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Lunary是Lunary开源的一个 LLM 的生产工具包。 Lunary 105a3f6版本存在资源管理错误漏洞，该漏洞源于允许用户上传和执行任意正则表达式，可能导致正则表达式拒绝服务攻击。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| lunary-ai | lunary-ai/lunary | unspecified ~ 1.4.23 | - |
II. CVE-2024-8789の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2024-8789のインテリジェンス情報
请登录查看更多情报信息。
Same Patch Batch · lunary-ai · 2025-03-20 · 22 CVEs total
| CVE-2024-10272 | Broken Access Control in lunary-ai/lunary | |
| CVE-2024-9096 | Improper Authorization in lunary-ai/lunary | |
| CVE-2024-9000 | Improper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary | |
| CVE-2024-9095 | Improper Authorization in lunary-ai/lunary | |
| CVE-2024-9098 | Privilege Escalation in lunary-ai/lunary | |
| CVE-2024-9099 | Exposure of Private API Keys in lunary-ai/lunary | |
| CVE-2024-10273 | Improper Privilege Management in lunary-ai/lunary | |
| CVE-2024-10762 | Missing Authorization in lunary-ai/lunary | |
| CVE-2024-10275 | Improper Role Modification by Admins for Billing Permissions in lunary-ai/lunary | |
| CVE-2024-10330 | Improper Access Control in lunary-ai/lunary | |
| CVE-2024-10274 | Improper Authorization in lunary-ai/lunary | |
| CVE-2025-0281 | Stored Cross-Site Scripting (XSS) in lunary-ai/lunary | |
| CVE-2024-11137 | IDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint in lunary-ai/lunary | |
| CVE-2024-11301 | Improper Enforcement of Unique Constraint in lunary-ai/lunary | |
| CVE-2024-11300 | Improper Access Control in lunary-ai/lunary | |
| CVE-2024-8763 | Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary | |
| CVE-2024-8764 | Improper Authorization in lunary-ai/lunary | |
| CVE-2024-8998 | Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary | |
| CVE-2024-8999 | Improper Access Control in lunary-ai/lunary | |
| CVE-2024-8765 | Improper Path Equivalence Resolution in lunary-ai/lunary |
Showing 20 of 22 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: lunary-ai/lunary
- CVE-2024-5386
Account Hijacking via Password Reset Token Leak in lunary-ai - CVE-2024-4147
Insufficient Access Control in lunary-ai/lunary - CVE-2025-9803
Improper Authentication in lunary-ai/lunary - CVE-2025-5352
Environment Variable XSS in Analytics Component in lunary-ai - CVE-2025-4962
IDOR Vulnerability in Template Creation via `projectId` Mani
同じベンダー: lunary-ai
- CVE-2024-5386
Account Hijacking via Password Reset Token Leak in lunary-ai - CVE-2024-4147
Insufficient Access Control in lunary-ai/lunary - CVE-2025-9803
Improper Authentication in lunary-ai/lunary - CVE-2025-5352
Environment Variable XSS in Analytics Component in lunary-ai - CVE-2025-4962
IDOR Vulnerability in Template Creation via `projectId` Mani
同じ弱点: CWE-1333
- CVE-2026-33079
Mistune ReDoS in LINK_TITLE_RE allows denial of service with - CVE-2026-41040
GROWI 安全漏洞 - CVE-2026-40319
Giskard has a Regular Expression Denial of Service (ReDoS) i - CVE-2026-5986
Zod jsVideoUrlParser util.js getTime redos - CVE-2026-35041
ReDoS in fast-jwt when using RegExp in allowed* leading to C
V. CVE-2024-8789へのコメント
まだコメントはありません