SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2023-36462

Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether.

MEDIUM 5.4EPSS 0.62%

Does this matter?

Lower severity and a low EPSS score (0.62%). Track it; it rarely justifies an emergency change on its own.

Description

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether. The link is visually misleading, but clicking on it will reveal the actual link. This can still be used for phishing, though, similar to IDN homograph attacks. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

CVSS 3.1
5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS
0.62% probability · 48th percentile
CISA KEV
Not listed
Weakness
CWE-20
Affected
joinmastodon/mastodon
Source
security-advisories@github.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.