CVE-2024-7472

Katalog CVE

CVSS 6.5 · Medium EPSS 0,46%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada lunary. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/signup). An unauthenticated attacker can inject data into outgoing emails by bypassing the extractFirstName function using a different whitespace character (e.g., \xa0). This vulnerability can be exploited to conduct phishing attacks, damage the application's brand, cause legal and compliance issues, and result in financial impact due to unauthorized email usage.

Rincian

Terbit di NVD

29 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lunary-ai/lunary/commit/a39837d7c49936a0c435d241f37ca2ea7904d2cd patch
• https://huntr.com/bounties/dc1feec6-1efb-4538-9b56-ab25deb80948 exploit · advisory pihak ketiga