Vulnerability · Published Oct 29, 2024 · Assigned by @huntr_ai

CVE-2024-7472Email Injection Vulnerability in lunary-ai/lunary

Medium 5.3

In plain English

A medium-severity security flaw in lunary-ai/lunary from lunary-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.0)5.3Medium

Exploit odds (30 days)0.5%top 60.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/signup). An unauthenticated attacker can inject data into outgoing emails by bypassing the extractFirstName function using a different whitespace character (e.g., \xa0). This vulnerability can be exploited to conduct phishing attacks, damage the application's brand, cause legal and compliance issues, and result in financial impact due to unauthorized email usage.

Affected products (as reported)

Vendor	Product	Versions
lunary-ai	lunary-ai/lunary	unspecified – before 1.4.10

Weakness: CWE-93 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In plain English

Official description

Affected products (as reported)

References