Cyber Resilience

CVE-2024-5755

Lunary ≤ 1.2.11

Public PoC
Published
27 June 2024
Modified
21 November 2024
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0034 27th percentile
Risk Priority 44 floored blend · peak EPSS

Summary

CVE-2024-5755 is a medium-severity Incorrect Synchronization (CWE-821) vulnerability in Lunary Lunary. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

This vulnerability is AI-related — categorised as LLM Application Platforms; in the Other ATLAS/OWASP Terms risk domain.

The strongest mitigations our analysis identified map to SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

In lunary-ai/lunary versions <=v1.2.11, an attacker can bypass email validation by using a dot character ('.') in the email address. This allows the creation of multiple accounts with essentially the same email address (e.g., 'attacker123@gmail.com' and 'attacker.123@gmail.com'), leading to incorrect…

more

synchronization and potential security issues.

CWE(s)

AI Security AnalysisAI

AI Category
LLM Application Platforms
Risk Domain
Other ATLAS/OWASP Terms
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Lunary.ai is an open-source LLM observability and analytics platform (lunary-ai/lunary), which falls under AI platforms for monitoring and managing AI/LLM deployments, best categorized as 'Other Platforms'. The vulnerability is in its account management, but the software is AI-related as confirmed by the AI/ML bug bounty context.

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-1902Same product: Lunary Lunary
CVE-2024-1739Same product: Lunary Lunary
CVE-2024-5130Same product: Lunary Lunary
CVE-2024-10272Same product: Lunary Lunary
CVE-2024-8999Same product: Lunary Lunary
CVE-2024-10274Same product: Lunary Lunary
CVE-2024-5129Same product: Lunary Lunary
CVE-2024-10762Same product: Lunary Lunary
CVE-2024-9095Same product: Lunary Lunary
CVE-2024-7475Same product: Lunary Lunary

Affected Assets

lunary
lunary
≤ 1.2.11

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-4 directly requires preventing unintended information transfer through shared resources, structurally blocking the concurrent unsynchronized access described by CWE-821.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require correct concurrency controls and synchronization primitives to prevent race conditions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect synchronization flaws before production deployment.

prevents

Secure SDLC practices include concurrency and synchronization requirements that reduce race conditions.

prevents

Application security requirements can mandate proper locking and thread-safety controls.

prevents

Secure architecture principles address concurrent access and resource synchronization.

prevents

Secure coding standards directly require correct synchronization primitives and thread-safety.

none

Change management processes can introduce or miss synchronization fixes during updates.

References