CVE-2024-5755

In lunary-ai/lunary versions <=v1.2.11, an attacker can bypass email validation by using a dot character ('.') in the email address. This allows the creation of multiple accounts with essentially the same email address (e.g., 'attacker123@gmail.com' and 'attacker.123@gmail.com'), leading to incorrect synchronization and potential security issues.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://huntr.com/bounties/cf337d37-e602-482b-aa7a-9e34e7f13e1f	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:*

History

19 Sep 2024, 15:49

Type	Values Removed	Values Added
CWE		NVD-CWE-Other
CPE		cpe:2.3:a:lunary:lunary::::::::
References	~~() https://huntr.com/bounties/cf337d37-e602-482b-aa7a-9e34e7f13e1f -~~	() https://huntr.com/bounties/cf337d37-e602-482b-aa7a-9e34e7f13e1f - Exploit, Third Party Advisory
Summary		(es) En las versiones lunary-ai/lunary <=v1.2.11, un atacante puede eludir la validación del correo electrónico utilizando un carácter de punto ('.') en la dirección de correo electrónico. Esto permite la creación de varias cuentas con esencialmente la misma dirección de correo electrónico (por ejemplo, 'attacker123@gmail.com' y 'attacker.123@gmail.com'), lo que genera una sincronización incorrecta y posibles problemas de seguridad.
First Time		Lunary lunary Lunary

27 Jun 2024, 19:25

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-27 19:15

Updated : 2024-09-19 15:49

NVD link : CVE-2024-5755

Mitre link : CVE-2024-5755

CVE.ORG link : CVE-2024-5755

JSON object : View

Products Affected

lunary

lunary

CWE

NVD-CWE-Other CWE-821

Incorrect Synchronization

{"id": "CVE-2024-5755", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-06-27T19:15:16.400", "references": [{"url": "https://huntr.com/bounties/cf337d37-e602-482b-aa7a-9e34e7f13e1f", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-821"}]}], "descriptions": [{"lang": "en", "value": "In lunary-ai/lunary versions <=v1.2.11, an attacker can bypass email validation by using a dot character ('.') in the email address. This allows the creation of multiple accounts with essentially the same email address (e.g., 'attacker123@gmail.com' and 'attacker.123@gmail.com'), leading to incorrect synchronization and potential security issues."}, {"lang": "es", "value": "En las versiones lunary-ai/lunary <=v1.2.11, un atacante puede eludir la validaci\u00f3n del correo electr\u00f3nico utilizando un car\u00e1cter de punto ('.') en la direcci\u00f3n de correo electr\u00f3nico. Esto permite la creaci\u00f3n de varias cuentas con esencialmente la misma direcci\u00f3n de correo electr\u00f3nico (por ejemplo, 'attacker123@gmail.com' y 'attacker.123@gmail.com'), lo que genera una sincronizaci\u00f3n incorrecta y posibles problemas de seguridad."}], "lastModified": "2024-09-19T15:49:40.417", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0203D40E-E996-464D-9F62-C3E7193128E6", "versionEndIncluding": "1.2.11"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}