6.5

CVE-2024-6582

Exploit

Broken Access Control in lunary-ai/lunary

A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Identity Provider (IDP) settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and potential account takeover if the email of a user in the target organization is known.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lunary ≫ Lunary Version < 1.4.9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.42% 0.332
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
security@huntr.dev 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://github.com/lunary-ai/lunary/commit/1f043d8798ad87346dfe378eea723bff78ad7433
Patch
https://huntr.com/bounties/251d138c-3911-4a81-96e5-5a4ab59a0b59
Third Party Advisory
Exploit