Vulnerability · Published Oct 4, 2023 · Assigned by GitHub_M

CVE-2023-43805Nexkey allows users to bypass authentication of Bull dashboard

High 7.5

In plain English

A high-severity improper authentication in nexkey from nexryai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 43.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF.

Affected products (as reported)

Vendor	Product	Versions
nexryai	nexkey	< 12.121.9

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf x_refsource_CONFIRM
https://github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc x_refsource_MISC
https://github.com/nexryai/nexkey/commit/d89575c521fd4492f5e2ba5a221c5e8f1382081d x_refsource_MISC