CVE-2024-32983
Last modified
CVE-2024-32983 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. This vulnerability is fixed in 2024.5.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Misskey | Misskey | < 2024.5.0 |
References
- https://github.com/misskey-dev/misskey/security/advisories/GHSA-2vxv-pv3m-3wvjExploit, Vendor Advisory
- https://github.com/misskey-dev/misskey/security/advisories/GHSA-2vxv-pv3m-3wvjExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-32983?
How severe is CVE-2024-32983?
How do I fix CVE-2024-32983?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-32978Kaminari is a paginator for web app frameworks and object re…6.6
- CVE-2024-32979Nautobot is a Network Source of Truth and Network Automation…6.1
- CVE-2024-3298Out-Of-Bounds Write and Type Confusion vulnerabilities exist…7.8
- CVE-2024-32980Spin is the developer tool for building and running serverle…9.1
- CVE-2024-32981Silverstripe framework is the PHP framework forming the base…5.4
- CVE-2024-32982Litestar and Starlite is an Asynchronous Server Gateway Inte…8.2
- CVE-2024-32984Yamux is a stream multiplexer over reliable, ordered connect…7.5
- CVE-2024-32985Stellar-core is a reference implementation for the peer-to-p…5.9
- CVE-2024-32986PWAsForFirefox is a tool to install, manage and use Progress…9.6
- CVE-2024-32987Microsoft SharePoint Server Information Disclosure Vulnerabi…7.5
- CVE-2024-32988'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'Off…7.5
- CVE-2024-32989Insufficient verification vulnerability in the system sharin…7.5
Are you affected by CVE-2024-32983?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST