CVE-2023-36460

CRITICAL

9.9

Description

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any location. This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

CVE Details

CVSS v3.1 Score9.9

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published7/6/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

joinmastodon:mastodon

Weaknesses (CWE)

CWE-22

References

http://www.openwall.com/lists/oss-security/2023/07/06/4(security-advisories@github.com)

https://github.com/mastodon/mastodon/commit/dc8f1fbd976ae544720a4e07120d9a91b2722440(security-advisories@github.com)

https://github.com/mastodon/mastodon/releases/tag/v3.5.9(security-advisories@github.com)

https://github.com/mastodon/mastodon/releases/tag/v4.0.5(security-advisories@github.com)

https://github.com/mastodon/mastodon/releases/tag/v4.1.3(security-advisories@github.com)

https://github.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fm(security-advisories@github.com)

http://www.openwall.com/lists/oss-security/2023/07/06/4(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/mastodon/mastodon/commit/dc8f1fbd976ae544720a4e07120d9a91b2722440(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/mastodon/mastodon/releases/tag/v3.5.9(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/mastodon/mastodon/releases/tag/v4.0.5(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/mastodon/mastodon/releases/tag/v4.1.3(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fm(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.