PT-2021-22426
CVE-2021-39169
·
Published
2021-08-27
·
Updated
2021-09-08
Description by
CVSS 3.1
8.0
HighMetricsAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Misskey versions prior to 12.51.0
Description
Misskey is a decentralized microblogging platform. In versions prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting (XSS). XSS could compromise the API request token.
Recommendations
For versions prior to 12.51.0, upgrade to version 12.51.0 to resolve the issue. As a temporary workaround, consider restricting access to the web client built-in dialog until the upgrade is applied.
Found an issue in the description? Have something to add? Feel free to write us 👾