CVE-2024-7472 Vulnerability Details

  /     /     /  

CVE-2024-7472 Metadata Quick Info

CVE Published: 29/10/2024 | CVE Updated: 29/10/2024 | CVE Year: 2024
Source: @huntr_ai | Vendor: lunary-ai | Product: lunary-ai/lunary
Status : PUBLISHED

---

CVE-2024-7472 Description

lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/signup). An unauthenticated attacker can inject data into outgoing emails by bypassing the extractFirstName function using a different whitespace character (e.g., \xa0). This vulnerability can be exploited to conduct phishing attacks, damage the application\'s brand, cause legal and compliance issues, and result in financial impact due to unauthorized email usage.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-75
CWE Name: CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
Source: lunary-ai

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).