CVE-2023-24812: SQL injection of notes/search-by-tag
Misskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient parameter validation in the note search API by tag (notes/search-by-tag). This has been fixed in version 13.3.3. Users are advised to upgrade. Users unable to upgrade should block access to the api/notes/search-by-tag endpoint.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-24812?
CVE-2023-24812 is a vulnerability in the Misskey open source social media platform that allows for SQL injection due to insufficient parameter validation in the note search API by tag.
What is the severity of CVE-2023-24812?
CVE-2023-24812 has a severity rating of 9.8, which is considered critical.
How can I fix CVE-2023-24812?
To fix CVE-2023-24812, users are advised to upgrade to version 13.3.3 of the Misskey platform.
Where can I find more information about CVE-2023-24812?
You can find more information about CVE-2023-24812 in the following references: - [GitHub Commit](https://github.com/misskey-dev/misskey/commit/ee74df68233adcd5b167258c621565f97c3b2306) - [GitHub Security Advisory](https://github.com/misskey-dev/misskey/security/advisories/GHSA-cgwp-vmr4-wx4q)
What is CWE-89?
CWE-89 refers to the vulnerability category of SQL Injection, which is the type of vulnerability present in CVE-2023-24812.