PT-2023-28985 · Misskey · Misskey
CVE-2023-43793
·
Publicado
2023-10-04
·
Atualizado
2023-10-11
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Misskey versions prior to 2023.9.0
Description
Misskey is an open source, decentralized social media platform. A user can bypass the authentication of the Bull dashboard, which is the job queue management UI, by editing the URL. This allows unauthorized access to the dashboard.
Recommendations
For versions prior to 2023.9.0, update to version 2023.9.0 to resolve the issue. As a temporary workaround, consider restricting access to the Bull dashboard until the update is applied.
Exploit
Correção
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Misskey