CVE-2023-42450: joinmastodon mastodon

csirt@kutim:~/threat-intel/cve/CVE-2023-42450

CVSS 7.5 · High EPSS 0,46%

Kerentanan Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') pada joinmastodon mastodon. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if the server configuration includes `ALLOWED_PRIVATE_ADDRESSES` to allow access to local exploitable services. Version 4.2.0-rc2 has a patch for the issue.

Rincian

Terbit di NVD: 19 September 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 0,46% peluang dieksploitasi; lebih tinggi dari 38,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
joinmastodon	mastodon	Versi 4.2.0 beta1
joinmastodon	mastodon	Versi 4.2.0 beta2
joinmastodon	mastodon	Versi 4.2.0 beta3
joinmastodon	mastodon	Versi 4.2.0 rc1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.