Mastodon
by Mastodon
Source repositories
CVEs (52)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-42452 | Med | 0.00 | 6.1 | 0.00 | Sep 19, 2023 | Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing… | ||
| CVE-2023-42451 | Hig | 0.00 | 7.4 | 0.01 | Sep 19, 2023 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10,… | ||
| CVE-2023-42450 | Med | 0.00 | 5.4 | 0.00 | Sep 19, 2023 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused… | ||
| CVE-2023-36462 | Med | 0.00 | 5.4 | 0.01 | Jul 6, 2023 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to… | ||
| CVE-2023-36461 | Hig | 0.00 | 7.5 | 0.01 | Jul 6, 2023 | Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the… | ||
| CVE-2023-36459 | Cri | 0.00 | 9.3 | 0.01 | Jul 6, 2023 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in… | ||
| CVE-2023-28853 | Hig | 0.00 | 7.7 | 0.01 | Apr 4, 2023 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the attacker can perform… | ||
| CVE-2022-48364 | Med | 0.00 | 4.3 | 0.01 | Mar 6, 2023 | The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was… | ||
| CVE-2022-2166 | Cri | 0.00 | 9.8 | 0.01 | Nov 16, 2022 | Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0. | ||
| CVE-2022-31263 | Med | 0.00 | 5.3 | 0.01 | May 24, 2022 | app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions. | ||
| CVE-2022-0432 | Med | 0.00 | 6.1 | 0.04 | Feb 2, 2022 | Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0. | ||
| CVE-2018-21018 | Cri | 0.00 | 9.8 | 0.03 | Sep 22, 2019 | Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions. |
- risk 0.00cvss 6.1epss 0.00
Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing…
- risk 0.00cvss 7.4epss 0.01
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10,…
- risk 0.00cvss 5.4epss 0.00
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused…
- risk 0.00cvss 5.4epss 0.01
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to…
- risk 0.00cvss 7.5epss 0.01
Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the…
- risk 0.00cvss 9.3epss 0.01
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in…
- risk 0.00cvss 7.7epss 0.01
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the attacker can perform…
- risk 0.00cvss 4.3epss 0.01
The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was…
- risk 0.00cvss 9.8epss 0.01
Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.
- risk 0.00cvss 5.3epss 0.01
app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.
- risk 0.00cvss 6.1epss 0.04
Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.
- risk 0.00cvss 9.8epss 0.03
Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.
Page 3 of 3