Is CVE-2024-6582 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-6582 being exploited in the wild.

How severe is CVE-2024-6582?

Low severity, with a CVSS score of 3, published 13 September 2024.

Which products and versions are affected?

lunary (npm) SEMVER:introduced=0,fixed=1.4.9.

Is there a fix for CVE-2024-6582?

Yes. lunary (npm): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-6582 attacked?

It is attacked over the network.

Am I affected by CVE-2024-6582?

Check whether you run lunary (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-6582: Lunary improper authentication in SAML configuration

CVE-2024-6582 · Severity: low · CVSS 3 · Published 2024-09-13

Lunary is an AI platform for managing language model interactions. A flaw in its SAML-based single sign-on (SSO) implementation allowed users to access and modify another organization's identity provider settings, potentially leading to unauthorized account access if an attacker knew a target user's email address.

Technologies: lunary (npm). Vendors: npm.

Quick answers

Is CVE-2024-6582 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-6582 being exploited in the wild.
How severe is CVE-2024-6582?: Low severity, with a CVSS score of 3, published 13 September 2024.
Which products and versions are affected?: lunary (npm) SEMVER:introduced=0,fixed=1.4.9.
Is there a fix for CVE-2024-6582?: Yes. lunary (npm): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-6582 attacked?: It is attacked over the network.
Am I affected by CVE-2024-6582?: Check whether you run lunary (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lunary (npm): upgrade to 1.4.9 or later
```
npm install lunary@1.4.9
```

Technical details

A broken access control vulnerability exists in the saml.ts component that fails to properly validate organization ownership when updating Identity Provider (IDP) settings or viewing SSO metadata. The vulnerability allows authenticated users to target and modify IDP configurations belonging to other organizations (CWE-287, CWE-306). Attack requires network access and valid authentication credentials, but no user interaction. An attacker can escalate to account takeover in the target organization if they know a victim's email. The vulnerability was fixed in version 1.4.9 (commit 1f043d8798ad87346dfe378eea723bff78ad7433).

Affected products

Lunary Lunary before 1.4.9

Identifiers

CVE-2024-6582
GHSA-w73r-8mm4-cfvf

Timeline

2024-09-13: disclosed: Vulnerability advisory published
2024-09-13: patched: Fix available in version 1.4.9
2024-11-25: other: Advisory withdrawn from npm package listing (incorrectly linked)

References

https://github.com/lunary-ai/lunary/commit/1f043d8798ad87346dfe378eea723bff78ad7433

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.