CVE-2024-7475

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An improper access control vulnerability in lunary-ai/lunary version 1.3.2 allows an attacker to update the SAML configuration without authorization. This vulnerability can lead to manipulation of authentication processes, fraudulent login requests, and theft of user information. Appropriate access controls should be implemented to ensure that the SAML configuration can only be updated by authorized users.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 29, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-74764.3A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated att CVE-2024-74776.7A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbi CVE-2024-74785.8When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernam CVE-2024-74798.8Improper verification of cryptographic signature during installation of a VPN driver via the TeamViewer_service.exe component of TeamViewer CVE-2024-74804.4An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with a CVE-2024-74818.8Improper verification of cryptographic signature during installation of a Printer driver via the TeamViewer_service.exe component of TeamVie CVE-2024-74847.2The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded CVE-2024-74857.2The Traffic Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in the 'UserWebStat' AJAX fun CVE-2024-74868.8The MultiPurpose theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.0 via deserialization o CVE-2024-74875.8An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentic CVE-2024-74885.3Integer Overflow or Wraparound, Improper Validation of Specified Quantity in Input vulnerability in RestApp Inc. Online Ordering System allo CVE-2024-74894.4The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fo