CVE-2023-36459
Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards.
Does this matter?
Lower severity and a low EPSS score (1.22%). Track it; it rarely justifies an emergency change on its own.
Description
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. This introduces a vector for cross-site scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.22% probability · 67th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- joinmastodon/mastodon
- Source
- security-advisories@github.com
References
- http://www.openwall.com/lists/oss-security/2023/07/06/5Mailing List
- https://github.com/mastodon/mastodon/commit/6d8e0fae3e96f3cf4febe03fa7fcf5b95ff761b2Patch, Third Party Advisory
- https://github.com/mastodon/mastodon/releases/tag/v3.5.9Third Party Advisory
- https://github.com/mastodon/mastodon/releases/tag/v4.0.5Third Party Advisory
- https://github.com/mastodon/mastodon/releases/tag/v4.1.3Third Party Advisory
- https://github.com/mastodon/mastodon/security/advisories/GHSA-ccm4-vgcc-73hpThird Party Advisory
- http://www.openwall.com/lists/oss-security/2023/07/06/5Mailing List
- https://github.com/mastodon/mastodon/commit/6d8e0fae3e96f3cf4febe03fa7fcf5b95ff761b2Patch, Third Party Advisory
- https://github.com/mastodon/mastodon/releases/tag/v3.5.9Third Party Advisory
- https://github.com/mastodon/mastodon/releases/tag/v4.0.5Third Party Advisory
- https://github.com/mastodon/mastodon/releases/tag/v4.1.3Third Party Advisory
- https://github.com/mastodon/mastodon/security/advisories/GHSA-ccm4-vgcc-73hpThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.