CVE-2023-42452

CVSS 3.1 Score 5.4 of 10 (medium)

Attack Complexity low
Scope changed
Confidentiality low
Integrity low
Privileges Required low
Availability none

Details

Published Sep 19, 2023
Updated: Sep 22, 2023
CWE ID 79

Summary

CVE-2023-42452 is a vulnerability affecting versions of the open-source social network server Mastodon, specifically those on the 4.x branch prior to 4.0.10, 4.2.8, and 4.2.0-rc2. This issue allows attackers to exploit the translation feature under certain conditions, bypassing server-side HTML sanitization and executing unescaped HTML in the user's browser. Although the impact is limited due to Mastodon's Content Security Policy, an attacker could potentially exploit a CSP bypass or loophole for malicious XSS. This vulnerability requires user interaction, as it can only be exploited upon clicking the “Translate” button on a malicious post. Versions 4.0.10, 4.2.8, and 4.2.0-rc2 have been released to address this issue.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share