Lucene search

GitHub_MCVELIST:CVE-2024-37903

HistoryJul 05, 2024 - 5:24 p.m.

CVE-2024-37903 Mastodon has improper authorship check on audience extension for existing posts

2024-07-0517:24:49

CWE-862

GitHub_M

www.cve.org

mastodon

microblogging platform

vulnerability

audience extension

patch

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS

Percentile

15.8%

JSON

Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue.

CNA Affected

[
  {
    "vendor": "mastodon",
    "product": "mastodon",
    "versions": [
      {
        "version": ">= 2.6.0, < 4.1.18",
        "status": "affected"
      },
      {
        "version": ">= 4.2.0, < 4.2.10",
        "status": "affected"
      }
    ]
  }
]

References

github.com/mastodon/mastodon/commit/a1c7aae28aecf06659c5b18cfa131b37cd1512a3

github.com/mastodon/mastodon/commit/d4bf22b632ea8b1174375c4966a6768ab66393b6

github.com/mastodon/mastodon/releases/tag/v4.1.18

github.com/mastodon/mastodon/releases/tag/v4.2.10

github.com/mastodon/mastodon/security/advisories/GHSA-xjvf-fm67-4qc3

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS

Percentile

15.8%

JSON

Related for CVELIST:CVE-2024-37903