CVE-2021-39169highCWE-79

CVE-2021-39169: falha de alta gravidade em misskey-dev misskey

XSS vulnerability using dialog

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar misskey

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8epss 0.7%
Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting (XSS). XSS could compromise the API request token. This issue has been fixed in version 12.51.0. There are no known workarounds aside from upgrading.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
misskey-dev · misskey
CVEs relacionadas — misskey-dev misskey

No mesmo produto, das mais perigosas para as menos.

CVE-2021-39195HIGHServer-Side Request Forgery vulnerability in misskeyEPSS 1.1%CVE-2023-43793HIGHMisskey allows users to bypass authentication of Bull dashboardEPSS 0.8%CVE-2023-24812HIGHSQL injection of notes/search-by-tagEPSS 0.7%CVE-2024-25636HIGHLack of media type verification of Activity Streams objects allows impersonation and takeover of remote accountsEPSS 0.7%CVE-2026-104816HIGHMisskey: Cross-site scripting in RSS feed item linksEPSS 0.6%CVE-2026-57575MEDIUMMisskey: SSRF bypass in URL PreviewEPSS 0.6%