by Kastro
Paper/Archive/CVE-2023-49079

CVE-2023-49079

misskey-dev misskey — Misskey's missing signature validation allows arbitrary users to impersonate any remote user.

EPSS 0.4%CVSS 9.3
critical.is priorityof 100
35
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 34.2.342 × 206.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1.

Affected

ProductAffectedFixed inSource
misskey< 2023.11.1-beta.1–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

References

refgithub.com/misskey-dev/misskey/security/advisories/GHSA-3f39-6537-3cgc