VYPR
← All advisories
High severity7.4NVD Advisory· Published Sep 19, 2023· Updated Jun 17, 2026

CVE-2023-42451

CVE-2023-42451

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2 contain a patch for this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

8
  • Mastodon/Mastodon7 versions
    cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*range: <3.5.14
    • cpe:2.3:a:joinmastodon:mastodon:4.2.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:joinmastodon:mastodon:4.2.0:beta2:*:*:*:*:*:*
    • cpe:2.3:a:joinmastodon:mastodon:4.2.0:beta3:*:*:*:*:*:*
    • cpe:2.3:a:joinmastodon:mastodon:4.2.0:rc1:*:*:*:*:*:*
    • (no CPE)range: <3.5.14, <4.0.10, <4.1.8, <4.2.0-rc2
    • (no CPE)range: < 3.5.14
  • osv-coords
    pkg:bitnami/mastodon
    Range: < 3.5.14

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.