Vulnerabilities > CVE-2023-36459 - Unspecified vulnerability in Joinmastodon Mastodon

CVSS 6.1 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

NONE

network

low complexity

joinmastodon

NVD

Published: 2023-07-06

Updated: 2024-11-21

Summary

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. This introduces a vector for cross-site scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

Vulnerable Configurations

Part	Description	Count
Application	Joinmastodon Joinmastodon Mastodon 4.0.0 Joinmastodon Mastodon 4.0.1 Joinmastodon Mastodon 4.0.2 Joinmastodon Mastodon 4.0.3 Joinmastodon Mastodon 4.0.4 Joinmastodon Mastodon 4.1.0 Joinmastodon Mastodon 4.1.1 Joinmastodon Mastodon 4.1.2 Joinmastodon Mastodon 1.3 Joinmastodon Mastodon 1.3.1 Joinmastodon Mastodon 1.3.2 Joinmastodon Mastodon 1.3.3 Joinmastodon Mastodon 1.4 Joinmastodon Mastodon 1.4.1 Joinmastodon Mastodon 1.4.2 Joinmastodon Mastodon 1.4.3 Joinmastodon Mastodon 1.4.4 Joinmastodon Mastodon 1.4.5 Joinmastodon Mastodon 1.4.6 Joinmastodon Mastodon 1.4.7 Joinmastodon Mastodon 1.5.0 Joinmastodon Mastodon 1.5.1 Joinmastodon Mastodon 1.6.0 Joinmastodon Mastodon 1.6.1 Joinmastodon Mastodon 2.0.0 Joinmastodon Mastodon 2.1.0 Joinmastodon Mastodon 2.1.1 Joinmastodon Mastodon 2.1.2 Joinmastodon Mastodon 2.1.3 Joinmastodon Mastodon 2.2.0 Joinmastodon Mastodon 2.3.0 Joinmastodon Mastodon 2.3.1 Joinmastodon Mastodon 2.3.2 Joinmastodon Mastodon 2.3.3 Joinmastodon Mastodon 2.4.0 Joinmastodon Mastodon 2.4.1 Joinmastodon Mastodon 2.4.2 Joinmastodon Mastodon 2.4.3 Joinmastodon Mastodon 2.4.4 Joinmastodon Mastodon 2.4.5 Joinmastodon Mastodon 2.5.0 Joinmastodon Mastodon 2.5.1 Joinmastodon Mastodon 2.5.2 Joinmastodon Mastodon 2.6.0 Joinmastodon Mastodon 2.6.1 Joinmastodon Mastodon 2.6.2 Joinmastodon Mastodon 2.6.3 Joinmastodon Mastodon 2.6.4 Joinmastodon Mastodon 2.6.5 Joinmastodon Mastodon 2.7.0 Joinmastodon Mastodon 2.7.1 Joinmastodon Mastodon 2.7.2 Joinmastodon Mastodon 2.7.3 Joinmastodon Mastodon 2.7.4 Joinmastodon Mastodon 2.8.0 Joinmastodon Mastodon 2.8.1 Joinmastodon Mastodon 2.8.2 Joinmastodon Mastodon 2.8.3 Joinmastodon Mastodon 2.8.4 Joinmastodon Mastodon 2.9.0 Joinmastodon Mastodon 2.9.1 Joinmastodon Mastodon 2.9.2 Joinmastodon Mastodon 2.9.3 Joinmastodon Mastodon 2.9.4 Joinmastodon Mastodon 3.0.0 Joinmastodon Mastodon 3.0.1 Joinmastodon Mastodon 3.0.2 Joinmastodon Mastodon 3.1.0 Joinmastodon Mastodon 3.1.1 Joinmastodon Mastodon 3.1.2 Joinmastodon Mastodon 3.1.3 Joinmastodon Mastodon 3.1.4 Joinmastodon Mastodon 3.1.5 Joinmastodon Mastodon 3.2.0 Joinmastodon Mastodon 3.2.1 Joinmastodon Mastodon 3.2.2 Joinmastodon Mastodon 3.3.0 Joinmastodon Mastodon 3.3.1 Joinmastodon Mastodon 3.3.2 Joinmastodon Mastodon 3.3.3 Joinmastodon Mastodon 3.4.0 Joinmastodon Mastodon 3.4.1 Joinmastodon Mastodon 3.4.2 Joinmastodon Mastodon 3.4.3 Joinmastodon Mastodon 3.4.4 Joinmastodon Mastodon 3.4.5 Joinmastodon Mastodon 3.4.6 Joinmastodon Mastodon 3.4.7 Joinmastodon Mastodon 3.4.8 Joinmastodon Mastodon 3.4.9 Joinmastodon Mastodon 3.4.10 Joinmastodon Mastodon 3.5.0 Joinmastodon Mastodon 3.5.1 Joinmastodon Mastodon 3.5.2 Joinmastodon Mastodon 3.5.3 Joinmastodon Mastodon 3.5.4 Joinmastodon Mastodon 3.5.5 Joinmastodon Mastodon 3.5.6 Joinmastodon Mastodon 3.5.7 Joinmastodon Mastodon 3.5.8	187

Vulnerabilities > CVE-2023-36459 - Unspecified vulnerability in Joinmastodon Mastodon

Summary

Vulnerable Configurations

Related news

References