Vulnerability Description
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. This introduces a vector for cross-site scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Joinmastodon | Mastodon | >= 1.3, < 3.5.9 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2023/07/06/5Mailing List
- https://github.com/mastodon/mastodon/commit/6d8e0fae3e96f3cf4febe03fa7fcf5b95ff7PatchThird Party Advisory
- https://github.com/mastodon/mastodon/releases/tag/v3.5.9Third Party Advisory
- https://github.com/mastodon/mastodon/releases/tag/v4.0.5Third Party Advisory
- https://github.com/mastodon/mastodon/releases/tag/v4.1.3Third Party Advisory
- https://github.com/mastodon/mastodon/security/advisories/GHSA-ccm4-vgcc-73hpThird Party Advisory
- http://www.openwall.com/lists/oss-security/2023/07/06/5Mailing List
- https://github.com/mastodon/mastodon/commit/6d8e0fae3e96f3cf4febe03fa7fcf5b95ff7PatchThird Party Advisory
- https://github.com/mastodon/mastodon/releases/tag/v3.5.9Third Party Advisory
- https://github.com/mastodon/mastodon/releases/tag/v4.0.5Third Party Advisory
- https://github.com/mastodon/mastodon/releases/tag/v4.1.3Third Party Advisory
- https://github.com/mastodon/mastodon/security/advisories/GHSA-ccm4-vgcc-73hpThird Party Advisory
FAQ
What is CVE-2023-36459?
CVE-2023-36459 is a vulnerability with a CVSS score of 9.3 (CRITICAL). Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can b...
How severe is CVE-2023-36459?
CVE-2023-36459 has been rated CRITICAL with a CVSS base score of 9.3/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-36459?
Check the references section above for vendor advisories and patch information. Affected products include: Joinmastodon Mastodon.