Vulnerability Description
Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated messages.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Joinmastodon | Mastodon | <= 4.0.2 |
Related Weaknesses (CWE)
References
- https://borg.social/notes/98bcoo2t1nIssue TrackingThird Party Advisory
- https://hackmd.io/rD9nsTz1QeuPT-erxqjY-AExploitIssue TrackingThird Party Advisory
- https://borg.social/notes/98bcoo2t1nIssue TrackingThird Party Advisory
- https://hackmd.io/rD9nsTz1QeuPT-erxqjY-AExploitIssue TrackingThird Party Advisory
FAQ
What is CVE-2022-46405?
CVE-2022-46405 is a vulnerability with a CVSS score of 7.5 (HIGH). Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated wi...
How severe is CVE-2022-46405?
CVE-2022-46405 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-46405?
Check the references section above for vendor advisories and patch information. Affected products include: Joinmastodon Mastodon.