Lunary 1.2.34

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:lunary:lunary:1.2.34:*:*:*:*:*:*:*

part: a version: 1.2.34 update: *

VendorLunary (d06a62eb-8728-5903-8388-539ff39c70e6)
ProductLunary (8681bafc-d844-59ba-bfe1-ff3e7976ea73)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/lunary-ai/lunary purl2cpe 2026-06-01 10:12:14.765519

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-6862 vulnerable 2026-06-08 06:58:20.617192 Cross-Site Request Forgery (CSRF) in lunary-ai/lunary
HIGH (7.4)
A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows an attacker to sign up for and create projects or use the instance as if they were a user with local access. The main attack vector is for instances hosted locally on personal machines, which are not publicly accessible. The CORS settings in the backend permit all origins, exposing unauthenticated endpoints to CSRF attacks.
Published: 2024-09-13T16:13:51.639Z
Updated: 2024-09-13T16:35:41.728Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.