CVE-2023-49079

2023-11-2919:15:07

CWE-347

[email protected]

web.nvd.nist.gov

misskey

open source

decentralized

social media platform

signature validation

security vulnerability

cve-2023-49079

nvd

patch

9.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

0.001 Low

EPSS

Percentile

31.3%

JSON

Misskey is an open source, decentralized social media platform. Misskey’s missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1.

Affected configurations

Vulners

NVD

Node

misskey-devmisskeyRange<2023.11.1-beta.1

CPENameOperatorVersion
misskey:misskeymisskeylt2023.11.1

CPE	Name	Operator	Version
misskey:misskey	misskey	lt	2023.11.1

CNA Affected

[
  {
    "vendor": "misskey-dev",
    "product": "misskey",
    "versions": [
      {
        "version": "< 2023.11.1-beta.1",
        "status": "affected"
      }
    ]
  }
]