PT-2023-7360 · Mastodon · Mastodon
Scumjr
·
Published
2023-09-19
·
Updated
2024-03-06
·
CVE-2023-42451
CVSS v3.1
7.4
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Mastodon versions prior to 3.5.14
Mastodon versions prior to 4.0.10
Mastodon versions prior to 4.1.8
Mastodon versions prior to 4.2.0-rc2
Description
The issue is related to a flaw in domain name normalization, which can be exploited by attackers to spoof domains they do not own. This can lead to a cache poisoning attack. Under certain circumstances, remote attackers can exploit this flaw.
Recommendations
For versions prior to 3.5.14, update to version 3.5.14 or later.
For versions prior to 4.0.10, update to version 4.0.10 or later.
For versions prior to 4.1.8, update to version 4.1.8 or later.
For versions prior to 4.2.0-rc2, update to version 4.2.0-rc2 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mastodon