CVE-2024-32983

Name: CVE-2024-32983
Creator: NVD / NIST
Published: 2024-06-03T16:15:08.567+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 0.40%

Last modified Jun 17, 2026

CVE-2024-32983 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. EPSS estimates a 0.40% chance of exploitation in the next 30 days.

Description

Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. This vulnerability is fixed in 2024.5.0.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Probability

0.40%

31.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-863

Affected Software

Vendor	Product	Versions
Misskey	Misskey	< 2024.5.0

References

https://github.com/misskey-dev/misskey/commit/d2a5bb39e344fcb84a24ae60faafe4694b227b88Patch
https://github.com/misskey-dev/misskey/security/advisories/GHSA-2vxv-pv3m-3wvjExploit, Vendor Advisory
https://github.com/misskey-dev/misskey/commit/d2a5bb39e344fcb84a24ae60faafe4694b227b88Patch
https://github.com/misskey-dev/misskey/security/advisories/GHSA-2vxv-pv3m-3wvjExploit, Vendor Advisory

Timeline

Published: Jun 3, 2024
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2024-32983?

How severe is CVE-2024-32983?

CVE-2024-32983 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.40% probability of exploitation in the next 30 days.

How do I fix CVE-2024-32983?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-32983?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST