CVE-2024-7475
Critical
Description
An improper access control vulnerability in lunary-ai/lunary version 1.3.2 allows an attacker to update the SAML configuration without authorization. This vulnerability can lead to manipulation of authentication processes, fraudulent login requests, and theft of user information. Appropriate access controls should be implemented to ensure that the SAML configuration can only be updated by authorized users.
SeverityCritical
CVSS9.1
Exploit probability—
ProductLunary
PublishedOct 29, 2024
First seenOct 29, 2024
Weakness typeCWE-862Missing authorization
How to fix
Update
- lunary lunary1.3.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lunary lunary | v < 1.3.4 | 1.3.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.