CVE-2023-49095

2023-11-3007:15:09

CWE-20

[email protected]

web.nvd.nist.gov

nexkey

microblogging platform

validation

activitypub

impersonation

security patch

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

0.0005 Low

EPSS

Percentile

17.3%

JSON

nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2.

Affected configurations

Vulners

NVD

Node

nexryainexkeyRange<12.122.2

VendorProductVersionCPE
nexryainexkey*cpe:2.3:a:nexryai:nexkey:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nexryai	nexkey	*	cpe:2.3:a:nexryai:nexkey::::::::

CNA Affected

[
  {
    "vendor": "nexryai",
    "product": "nexkey",
    "versions": [
      {
        "version": "< 12.122.2",
        "status": "affected"
      }
    ]
  }
]