Vulnerability · Published Feb 2, 2022 · Assigned by @huntrdev
CVE-2022-0432Prototype Pollution in mastodon/mastodon
High 7.4
In plain English
A high-severity prototype pollution in mastodon/mastodon from mastodon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.4% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.0)7.4High
Exploit odds (30 days)4.4%top 8.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mastodon | mastodon/mastodon | unspecified – before 3.5.0 |
Weakness: CWE-1321 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
References
- https://huntr.dev/bounties/d06da292-7716-4d74-a129-dd04773398d7 x_refsource_CONFIRM
- https://github.com/mastodon/mastodon/commit/4d6d4b43c6186a13e67b92eaf70fe1b70ea24a09 x_refsource_MISC