GitHub_MCVELIST:CVE-2023-42451CVE-2023-42451 Mastodon Invalid Domain Name Normalization vulnerability
7.4 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
0.0005 Low
EPSS
Percentile
18.0%
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2 contain a patch for this issue.
CNA Affected
[
{
"vendor": "mastodon",
"product": "mastodon",
"versions": [
{
"version": "< 3.5.14",
"status": "affected"
},
{
"version": ">= 4.0.0, < 4.0.10",
"status": "affected"
},
{
"version": ">= 4.1.0, < 4.1.8",
"status": "affected"
},
{
"version": ">= 4.2.0-beta1, < 4.2.0-rc2",
"status": "affected"
}
]
}
]Related
7.4 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
0.0005 Low
EPSS
Percentile
18.0%