PT-2024-9680 · Lunary · Lunary

Published 2024-10-29 · Updated 2024-11-04 · CVE-2024-7475

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Lunary version 1.3.2

Description The issue is related to insufficient access control, allowing a remote attacker to impact the confidentiality and integrity of protected information by updating the SAML configuration. This can lead to manipulation of authentication processes, fraudulent login requests, and theft of user information.

Recommendations For version 1.3.2, implement appropriate access controls to ensure that the SAML configuration can only be updated by authorized users. As a temporary workaround, consider restricting access to the SAML configuration update functionality until a patch is available.

Exploit

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

BDU:2024-11392

CVE-2024-7475

Affected Products

Lunary

References · 8

• 🔥 https://huntr.com/bounties/78c824f7-3b6d-443d-bb76-0f8031c6c126 · Exploit
• https://github.com/lunary-ai/lunary/commit/8f563c77d8614a72980113f530c7a9ec15a5f8d5 · Patch
• https://bdu.fstec.ru/vul/2024-11392 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-7475 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7475 · Vendor Advisory
• https://twitter.com/CCBalert/status/1852009091314467058 · Twitter Post
• https://t.me/cvenotify/100503 · Telegram Post
• https://t.me/cvedetector/9318 · Telegram Post