CVE-2022-24307

Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JSON-LD signing has been supported since version 1.6.0.)
References
Link Resource
https://github.com/mastodon/mastodon/releases/tag/v3.3.2 Release Notes Third Party Advisory
https://github.com/mastodon/mastodon/releases/tag/v3.4.6 Release Notes Third Party Advisory
https://github.com/mastodon/mastodon/releases/tag/v3.3.2 Release Notes Third Party Advisory
https://github.com/mastodon/mastodon/releases/tag/v3.4.6 Release Notes Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*
cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:50

Type Values Removed Values Added
References () https://github.com/mastodon/mastodon/releases/tag/v3.3.2 - Release Notes, Third Party Advisory () https://github.com/mastodon/mastodon/releases/tag/v3.3.2 - Release Notes, Third Party Advisory
References () https://github.com/mastodon/mastodon/releases/tag/v3.4.6 - Release Notes, Third Party Advisory () https://github.com/mastodon/mastodon/releases/tag/v3.4.6 - Release Notes, Third Party Advisory

Information

Published : 2022-02-03 20:15

Updated : 2024-11-21 06:50


NVD link : CVE-2022-24307

Mitre link : CVE-2022-24307

CVE.ORG link : CVE-2022-24307


JSON object : View

Products Affected

joinmastodon

  • mastodon
CWE
CWE-863

Incorrect Authorization