CVE-2023-42451

HIGH

Mastodon <3.5.14, <4.0.10, <4.1.8, <4.2.0-rc2 - Open Redirect

Title source: llm
STIX 2.1

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2 contain a patch for this issue.

References (2)

Scores

CVSS v3 7.4
EPSS 0.0031
EPSS Percentile 54.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-706
Status published
Products (2)
joinmastodon/mastodon 4.2.0 beta1 (4 CPE variants)
joinmastodon/mastodon < 3.5.14
Published Sep 19, 2023
Tracked Since Feb 18, 2026