Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2 contain a patch for this issue.
References
Configurations
Configuration 1 (hide)
|
History
22 Sep 2023, 17:10
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Joinmastodon mastodon
Joinmastodon |
|
| References | (MISC) https://github.com/mastodon/mastodon/security/advisories/GHSA-v3xf-c9qf-j667 - Vendor Advisory | |
| References | (MISC) https://github.com/mastodon/mastodon/commit/eeab3560fc0516070b3fb97e089b15ecab1938c8 - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:* cpe:2.3:a:joinmastodon:mastodon:4.2.0:beta2:*:*:*:*:*:* cpe:2.3:a:joinmastodon:mastodon:4.2.0:beta3:*:*:*:*:*:* cpe:2.3:a:joinmastodon:mastodon:4.2.0:rc1:*:*:*:*:*:* cpe:2.3:a:joinmastodon:mastodon:4.2.0:beta1:*:*:*:*:*:* |
19 Sep 2023, 17:57
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-19 16:15
Updated : 2023-12-10 15:14
NVD link : CVE-2023-42451
Mitre link : CVE-2023-42451
CVE.ORG link : CVE-2023-42451
JSON object : View
Products Affected
joinmastodon
- mastodon
CWE
CWE-706
Use of Incorrectly-Resolved Name or Reference