PT-2023-19795 · Misskey · Misskey

Ry0Tak · CVE-2023-24811 · Publicado 2023-02-22 · Atualizado 2023-03-03

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Misskey versions prior to 13.3.2

Description The issue concerns a cross-site scripting vulnerability due to insufficient URL validation in the URL preview function. This allows arbitrary JavaScript to be executed when a malicious URL is loaded in the View in Player or View in Window preview.

Recommendations For versions prior to 13.3.2, upgrade to version 13.3.2 to resolve the issue. For users unable to upgrade, avoid using the View in Player or View in Window functions as a temporary workaround.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-24811

GHSA-VC39-C453-67G3

Produtos afetados

Misskey

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24811.json · Exploit
• https://github.com/misskey-dev/misskey/commit/38f9d1e76428bea47c5944c440eab25428c7d99e · Correção
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-vc39-c453-67g3 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-24811 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-24811 · Nota de Segurança