CVE-2023-52139: Misskey vulnerable to improper authorization when accessing with third-party application
Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as kind or secure without the user's permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version 2023.12.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52139?
CVE-2023-52139 is classified as a moderate severity vulnerability affecting certain versions of Misskey.
How do I fix CVE-2023-52139?
To address CVE-2023-52139, users should upgrade their Misskey instances to version 2023.12.1 or later.
What type of vulnerability is CVE-2023-52139?
CVE-2023-52139 is a security vulnerability related to access control in third-party applications on the Misskey platform.
What software is affected by CVE-2023-52139?
CVE-2023-52139 affects Misskey versions prior to 2023.12.1.
Can CVE-2023-52139 be exploited remotely?
Yes, CVE-2023-52139 could potentially be exploited by remote attackers using improperly specified endpoints or WebSocket APIs.