CVE-2023-42452 Mastodon vulnerable to Stored XSS through the translation feature

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing unescaped HTML to...

CVE-2023-42452

Mastodon CVE-2023-42452 affects 4.x branches prior to 4.0.10, 4.2.8, and 4.2.0-rc2. The issue allows Stored XSS via the translation feature by bypassing server-side HTML sanitization and executing unescaped HTML in the browser. Exploitation requires user interaction (clicking the Translate button...

CVE-2023-42452 Mastodon vulnerable to Stored XSS through the translation feature

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing unescaped HTML to...

CVE-2023-42451 Mastodon Invalid Domain Name Normalization vulnerability

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc...

CVE-2023-42451 Mastodon Invalid Domain Name Normalization vulnerability

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc...

CVE-2023-42451

CVE-2023-42451 affects Mastodon: prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, there is a flaw in domain name normalization that can allow attackers to spoof domains they do not own under certain circumstances. A patch exists in versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2. The root ca...

CVE-2023-42451 Mastodon Invalid Domain Name Normalization vulnerability

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc...

CVE-2023-42450

Mastodon (ActivityPub-based) is affected in versions up to 4.2.0-rc2 where crafting specific input can inject arbitrary data into HTTP requests issued by the server. The issue enables confused deputy attacks if ALLOWED_PRIVATE_ADDRESSES permits access to local exploitable services. A patch exists...

CVE-2023-42450 Mastodon Server-Side Request Forgery vulnerability

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if...

CVE-2023-42450 Mastodon Server-Side Request Forgery vulnerability

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if...

CVE-2023-42450 Mastodon Server-Side Request Forgery vulnerability

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if...

Mastodon Code Issue Vulnerability

Mastodon is an open source social network server based on ActivityPub. A code issue vulnerability exists in Mastodon versions 4.2.0-beta1 through 4.2.0-rc2, which can be exploited by an attacker to inject arbitrary data into HTTP requests sent by Mastodon by crafting specific inputs...

PT-2023-6629 · Mastodon · Mastodon

Name of the Vulnerable Software and Affected Versions: Mastodon versions 4.2.0-beta1 through 4.2.0-rc1 Description: The issue is related to insufficient request validation on the server side, allowing attackers to inject arbitrary data into HTTP requests issued by Mastodon. This can be used to...

Mastodon Cross-Site Scripting Vulnerability

Mastodon is an open source social network server based on ActivityPub. A cross-site scripting vulnerability exists in Mastodon versions prior to 3.5.14, prior to 4.0.10, prior to 4.1.8, and prior to 4.2.0-rc2, which stems from the fact that under certain circumstances, an attacker can abuse the...

Mastodon Security Vulnerability

Mastodon is an open source social networking server based on ActivityPub. A security vulnerability exists in Mastodon versions prior to 3.5.14, prior to 4.0.10, prior to 4.1.8, and prior to 4.2.0-rc2, which stems from the fact that, under certain circumstances, an attacker can exploit flaws in...

PT-2023-7360 · Mastodon · Mastodon

Name of the Vulnerable Software and Affected Versions: Mastodon versions prior to 3.5.14 Mastodon versions prior to 4.0.10 Mastodon versions prior to 4.1.8 Mastodon versions prior to 4.2.0-rc2 Description: The issue is related to a flaw in domain name normalization, which can be exploited by...

CVE-2023-39780

creationtimestamp| type| source ---|---|--- 2023-09-11 22:27:52+00:00| seen| https://t.me/cibsecurity/70228 2025-05-28 13:22:26+00:00| seen| https://mastodon.social/users/hrbrmstr/statuses/114585668337631439 2025-05-28 13:22:40+00:00| seen| https://bsky.app/profile/hrbrmstr.dev/post/3lqacdnwi5f2e...

Mozilla: Mozilla Mastodon Staging Instance Admin API Key Disclosure Through Slack

Admin Mastodon API keys were inadvertently disclosed in the trust-and-safety-eng channel on Mozilla's Slack workspace, potentially granting unauthorized access to the Mastodon server and compromising user data. Immediate action is required to mitigate this vulnerability...

"TootRoot" Mastodon vulnerabilities fixed: Admins, patch now!

One of Twitters big rivals, Mastodon, recently finished fixing four issues which in the worst case allowed for the creation of files on the instances server. Mastodon, whose main selling point is lots of separate communities living on different servers yet still able to communicate, was notified ...

Mastodon Social Network Patches Critical Flaws Allowing Server Takeover

Mastodon, a popular decentralized social network, has released a security update to fix critical vulnerabilities that could expose millions of users to potential attacks. Mastodon is known for its federated model, consisting of thousands of separate servers called "instances," and it has over 14...