Description

A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Identity Provider (IDP) settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and potential account takeover if the email of a user in the target organization is known.

INFO

Published Date :

2024-09-13T16:11:39.817Z

Last Modified :

2024-11-03T18:27:25.362Z

Source :

@huntr_ai
AFFECTED PRODUCTS

The following products are affected by CVE-2024-6582 vulnerability.

Vendors Products
Lunary
  • Lunary
Lunary-ai
  • Lunary-ai\/lunary
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-6582.

URL Resource
https://github.com/lunary-ai/lunary/commit/1f043d8798ad87346dfe378eea723bff78ad7433 cve-icon cve-icon
https://huntr.com/bounties/251d138c-3911-4a81-96e5-5a4ab59a0b59 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact