Improper Access Control in Lunary AI Software Affecting User Authentication
CVE-2024-7475
9.1CRITICAL
What is CVE-2024-7475?
This vulnerability results from improper access control mechanisms in Lunary AI's lunary product version 1.3.2, which allows an unauthorized attacker to modify the SAML configuration. Such unauthorized modifications can disrupt normal authentication processes, potentially enabling fraudulent login attempts and compromising sensitive user information. To mitigate this risk, it is essential for organizations using Lunary AI's solutions to enforce strict access controls and ensure that only authorized personnel have permission to update SAML configurations.
Affected Version(s)
lunary-ai/lunary < 1.3.4
References
CVSS V3.1
Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
CVSS V3.0
Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published