CVE-2024-23649
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Summary
CVE-2024-23649 is a vulnerability affecting the Lemmy link aggregator and forum used in the fediverse. In versions 0.17.0 through 0.19.0, users, including those without sending or receiving privileges, can report private messages, leading to the exposure of the entire content of the private message. This issue arises due to the unvalidated API response that includes the private message itself. An instance admin can also exploit this vulnerability if the private message is removed from the response. The required privileges to exploit this vulnerability depend on the instance configuration. The vulnerability has been patched in version 0.19.1, and a workaround or blocking the API route in the reverse proxy can be implemented as a temporary measure until the update is applied.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions