CVE-2024-32983: fallo de gravedad alta en misskey-dev misskey
Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activities
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.2epss 0.4%
Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. This vulnerability is fixed in 2024.5.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Productos afectados
misskey-dev · misskeyCVEs relacionadas — misskey-dev misskey
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-39195HIGHServer-Side Request Forgery vulnerability in misskeyEPSS 1.1%CVE-2023-43793HIGHMisskey allows users to bypass authentication of Bull dashboardEPSS 0.8%CVE-2021-39169HIGHXSS vulnerability using dialogEPSS 0.7%CVE-2023-24812HIGHSQL injection of notes/search-by-tagEPSS 0.7%CVE-2024-25636HIGHLack of media type verification of Activity Streams objects allows impersonation and takeover of remote accountsEPSS 0.7%CVE-2026-104816HIGHMisskey: Cross-site scripting in RSS feed item linksEPSS 0.6%