CVE-2024-6862: lunary — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2024-6862

CVSS 8.1 · High EPSS 0,29%

Kerentanan Cross-Site Request Forgery (CSRF) pada lunary. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows an attacker to sign up for and create projects or use the instance as if they were a user with local access. The main attack vector is for instances hosted locally on personal machines, which are not publicly accessible. The CORS settings in the backend permit all origins, exposing unauthenticated endpoints to CSRF attacks.

Rincian

Terbit di NVD: 13 September 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-352: Cross-Site Request Forgery (CSRF)
EPSS (30 hari): 0,29% peluang dieksploitasi; lebih tinggi dari 20,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
lunary	lunary	Versi 1.2.34

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/lunary-ai/lunary/commit/3451fcd7b9d95e9091d62c515752f39f2faa6e54 patch
https://huntr.com/bounties/0b1d851e-3455-480c-ad5a-23565894976f exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.