PT-2023-19795 · Misskey · Misskey

Ry0Tak · Published 2023-02-22 · Updated 2023-03-03 · CVE-2023-24811

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Misskey versions prior to 13.3.2

Description The issue concerns a cross-site scripting vulnerability due to insufficient URL validation in the URL preview function. This allows arbitrary JavaScript to be executed when a malicious URL is loaded in the View in Player or View in Window preview.

Recommendations For versions prior to 13.3.2, upgrade to version 13.3.2 to resolve the issue. For users unable to upgrade, avoid using the View in Player or View in Window functions as a temporary workaround.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-24811

GHSA-VC39-C453-67G3

Affected Products

Misskey

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24811.json · Exploit
• https://github.com/misskey-dev/misskey/commit/38f9d1e76428bea47c5944c440eab25428c7d99e · Patch
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-vc39-c453-67g3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-24811 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24811 · Security Note