CVE-2023-36462: joinmastodon mastodon

csirt@kutim:~/threat-intel/cve/CVE-2023-36462

CVSS 5.4 · Medium EPSS 0,62%

Kerentanan Improper Input Validation pada joinmastodon mastodon. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether. The link is visually misleading, but clicking on it will reveal the actual link. This can still be used for phishing, though, similar to IDN homograph attacks. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

Rincian

Terbit di NVD: 6 Juli 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-20: Improper Input Validation
EPSS (30 hari): 0,62% peluang dieksploitasi; lebih tinggi dari 48,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
joinmastodon	mastodon	Versi 2.6.0 hingga sebelum 3.5.9
joinmastodon	mastodon	Versi 4.0.0 hingga sebelum 4.0.5
joinmastodon	mastodon	Versi 4.1.0 hingga sebelum 4.1.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/mastodon/mastodon/security/advisories/GHSA-55j9-c3mp-6fcq advisory vendor
https://github.com/mastodon/mastodon/commit/610731b03dfcadd887078cb0399f4e514aa1931c patch
https://github.com/mastodon/mastodon/releases/tag/v3.5.9 release notes
https://github.com/mastodon/mastodon/releases/tag/v4.0.5 release notes
https://github.com/mastodon/mastodon/releases/tag/v4.1.3 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.