CVE-2023-49952: XSS
Published Nov 18, 2024
·Updated
Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header.
Affected Software
3 affected components
Mastodon Mastodon<4.1.17, <4.2.9
Joinmastodon Mastodon>=4.1.0<4.1.17
Joinmastodon Mastodon>=4.2.0<4.2.9
Event History
Nov 18, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-49952?
CVE-2023-49952 has a severity rating that indicates the potential for significant impact on the affected systems due to rate limiting bypass.
2
How do I fix CVE-2023-49952?
To fix CVE-2023-49952, upgrade to Mastodon version 4.1.17 or 4.2.9 or later, which addresses the vulnerability.
3
What versions of Mastodon are affected by CVE-2023-49952?
Mastodon versions prior to 4.1.17 and 4.2.9 are affected by CVE-2023-49952.
4
What does CVE-2023-49952 exploit?
CVE-2023-49952 exploits a misconfiguration allowing attackers to bypass rate limiting through crafted HTTP request headers.
5
Is there any workaround for CVE-2023-49952?
There are no recommended workarounds for CVE-2023-49952; the best mitigation is upgrading to the patched versions.