CVE-2024-1739
Assigner: @huntr_ai
Published: 2024-04-16T00:00:15.208Z
State: PUBLISHED
title: Case Insensitive Email Address Validation Vulnerability in lunary-ai/lunary
descriptions: value: lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the case of the email characters. For example, accounts for 'abc@gmail.com' and 'Abc@gmail.com' can both be created, leading to potential impersonation and confusion among users.
affected: vendor: lunary-ai
product: lunary-ai/lunary
versions: version: unspecified
lessThan: 1.0.2
status: affected
versionType: custom
metrics: cvssV3_0: version: 3.0
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-821 Incorrect Synchronization
cweId: CWE-821
source: advisory: 2ca70ba5-b6a4-4873-bd55-bc6cef40d300
discovery: EXTERNAL