Strix
26.1K

CVE-2023-36462

MEDIUMCVSS 5.4/10EPSS 0.53%

Last modified

CVE-2023-36462 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether. EPSS estimates a 0.53% chance of exploitation in the next 30 days.

Description

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether. The link is visually misleading, but clicking on it will reveal the actual link. This can still be used for phishing, though, similar to IDN homograph attacks. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

Metrics

CVSS 3.1
5.4/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS Probability
0.53%

40.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
JoinmastodonMastodon>= 2.6.0, < 3.5.9
JoinmastodonMastodon>= 4.0.0, < 4.0.5
JoinmastodonMastodon>= 4.1.0, < 4.1.3

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-36462?
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether. The link is visually misleading, but clicking on it will reveal the actual link. This can still be used for phishing, though, similar to IDN homograph attacks. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.
How severe is CVE-2023-36462?
CVE-2023-36462 has a CVSS score of 5.4/10 (MEDIUM severity). The EPSS model estimates a 0.53% probability of exploitation in the next 30 days.
How do I fix CVE-2023-36462?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-36462?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST