CVE-2024-5478

Katalog CVE

CVSS 6.1 · Medium EPSS 0,35%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada lunary. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

A Cross-site Scripting (XSS) vulnerability exists in the SAML metadata endpoint `/auth/saml/${org?.id}/metadata` of lunary-ai/lunary version 1.2.7. The vulnerability arises due to the application's failure to escape or validate the `orgId` parameter supplied by the user before incorporating it into the generated response. Specifically, the endpoint generates XML responses for SAML metadata, where the `orgId` parameter is directly embedded into the XML structure without proper sanitization or validation. This flaw allows an attacker to inject arbitrary JavaScript code into the generated SAML metadata page, leading to potential theft of user cookies or authentication tokens.

Rincian

Terbit di NVD

6 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/e899f496-d493-4c06-b596-cb0a88ad451b exploit · issue tracking