CVE-2024-23832

Katalog CVE

CVSS 9.8 · Critical EPSS 2,5%

Kerentanan Authentication Bypass by Spoofing pada joinmastodon mastodon. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions prior to 4.2.5.

Rincian

Terbit di NVD

1 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

2,5% peluang dieksploitasi; lebih tinggi dari 83,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw advisory vendor
• http://www.openwall.com/lists/oss-security/2024/02/02/4 mailing list · patch
• https://github.com/mastodon/mastodon/commit/1726085db5cd73dd30953da858f9887bcc90b958 patch