CVE-2024-1739

Katalog CVE

CVSS 9.1 · Critical EPSS 0,56%

Kerentanan Incorrect Synchronization pada lunary. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the case of the email characters. For example, accounts for 'abc@gmail.com' and 'Abc@gmail.com' can both be created, leading to potential impersonation and confusion among users.

Rincian

Terbit di NVD

16 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-821: Incorrect Synchronization

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lunary-ai/lunary/commit/7351157a21e5acd0162b4528bcae9d65b1c95695 patch
• https://huntr.com/bounties/2ca70ba5-b6a4-4873-bd55-bc6cef40d300 exploit · advisory pihak ketiga