Vulnerability · Published Nov 29, 2023 · Assigned by GitHub_M
CVE-2023-49079Misskey's missing signature validation allows arbitrary users to impersonate any remote user.
Critical 9.3
In plain English
A critical-severity security flaw in misskey from misskey-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.4%top 65.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| misskey-dev | misskey | < 2023.11.1-beta.1 |
Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
References
- https://github.com/misskey-dev/misskey/security/advisories/GHSA-3f39-6537-3cgc x_refsource_CONFIRM