CVE-2024-6862: A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows…

PriorityP341high8.1CVSS 3.1

AVNACLPRNUIRSUCHIHAN

EPSS

0.27%

19.2th percentile

A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows an attacker to sign up for and create projects or use the instance as if they were a user with local access. The main attack vector is for instances hosted locally on personal machines, which are not publicly accessible. The CORS settings in the backend permit all origins, exposing unauthenticated endpoints to CSRF attacks.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
lunary-ai	lunary-ai_lunary	>= unspecified < 1.4.10	1.4.10
lunary	backend	>= 0 < 1.4.10	1.4.10
lunary	lunary	—	—
lunary	lunary	>= 0 < 1.4.10	1.4.10

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

nvdv3.07.4HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.