« Volver al listado

CVE-2023-42452

Estado: ModificadaMedia (5.4)—

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing unescaped HTML to execute in the browser. The impact is limited thanks to Mastodon's strict Content Security Policy, blocking inline scripts, etc. However a CSP bypass or loophole could be exploited to execute malicious XSS. Furthermore, it requires user interaction, as this can only occur upon clicking the “Translate” button on a malicious post. Versions 4.0.10, 4.2.8, and 4.2.0-rc2 contain a patch for this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Joinmastodon — Mastodon

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-42452",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-42452",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-24T18:00:36.912577Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "mastodon",
          "product": "mastodon",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.0.0, < 4.0.10"
            },
            {
              "status": "affected",
              "version": ">= 4.1.0, < 4.1.8"
            },
            {
              "status": "affected",
              "version": ">= 4.2.0-beta1, < 4.2.0-rc2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-09-19T16:15:13.630",
  "references": [
    {
      "url": "https://github.com/mastodon/mastodon/commit/ff32475f5f4a84ebf9619e7eef5bf8b4c075d0e2",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-2693-xr3m-jhqr",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mastodon/mastodon/commit/ff32475f5f4a84ebf9619e7eef5bf8b4c075d0e2",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-2693-xr3m-jhqr",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing unescaped HTML to execute in the browser. The impact is limited thanks to Mastodon's strict Content Security Policy, blocking inline scripts, etc. However a CSP bypass or loophole could be exploited to execute malicious XSS. Furthermore, it requires user interaction, as this can only occur upon clicking the “Translate” button on a malicious post. Versions 4.0.10, 4.2.8, and 4.2.0-rc2 contain a patch for this issue."
    },
    {
      "lang": "es",
      "value": "Mastodon es un servidor de red social gratuito y de código abierto basado en ActivityPub. En las versiones de la rama 4.x anteriores a las versiones 4.0.10, 4.2.8 y 4.2.0-rc2, bajo ciertas condiciones, los atacantes pueden abusar de la función de traducción para evitar la sanitización de HTML del lado del servidor, permitiendo que se ejecute HTML sin escape en el navegador. El impacto es limitado gracias a la estricta Política de Seguridad de Contenido de Mastodon, el bloqueo de scripts en línea, etc. Sin embargo, se podría aprovechar una omisión o laguna del CSP para ejecutar XSS malicioso. Además, requiere la interacción del usuario, ya que esto sólo puede ocurrir al hacer clic en el botón \"Traducir\" en una publicación maliciosa. Las versiones 4.0.10, 4.2.8 y 4.2.0-rc2 contienen un parche para este problema."
    }
  ],
  "lastModified": "2026-06-17T06:23:51.647",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98C89C5A-7235-4260-8656-CA90DB36CC96",
              "versionEndExcluding": "4.0.10",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E58F736C-6245-4EF4-AE4D-FB6AA20F0D7B",
              "versionEndExcluding": "4.1.8",
              "versionStartIncluding": "4.1.0"
            },
            {
              "criteria": "cpe:2.3:a:joinmastodon:mastodon:4.2.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D76FF8DD-B11D-4119-9B4E-32CE8365A25B"
            },
            {
              "criteria": "cpe:2.3:a:joinmastodon:mastodon:4.2.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19DC8A22-E8EF-4FAB-B60E-64FE54AE0968"
            },
            {
              "criteria": "cpe:2.3:a:joinmastodon:mastodon:4.2.0:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1406EB6A-186B-4A9C-95F6-5EC509867C3C"
            },
            {
              "criteria": "cpe:2.3:a:joinmastodon:mastodon:4.2.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "089015EE-D7E4-4370-B1ED-52283B06FF0A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}