CVE-2024-7472: Email Injection Vulnerability in lunary-ai/lunary
First published: Tue Oct 29 2024(Updated: )
lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/signup). An unauthenticated attacker can inject data into outgoing emails by bypassing the extractFirstName function using a different whitespace character (e.g., \xa0). This vulnerability can be exploited to conduct phishing attacks, damage the application's brand, cause legal and compliance issues, and result in financial impact due to unauthorized email usage.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| lunary lunary | =1.2.26 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-7472?
CVE-2024-7472 is rated as a moderate severity vulnerability due to its potential for email injection.
How do I fix CVE-2024-7472?
To fix CVE-2024-7472, update to the latest version of lunary that patches the email injection vulnerability.
What impact does CVE-2024-7472 have on systems using lunary v1.2.26?
CVE-2024-7472 allows unauthenticated attackers to inject malicious data into outgoing emails, potentially leading to phishing attacks.
Is CVE-2024-7472 exploitable without authentication?
Yes, CVE-2024-7472 can be exploited by unauthenticated attackers via the Send email verification API and Sign up API.
Which versions of lunary are affected by CVE-2024-7472?
CVE-2024-7472 specifically affects lunary version 1.2.26.
- agent/title
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/event
- agent/remedy
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/lunary
- canonical/lunary lunary
- version/lunary lunary/1.2.26