CVE-2024-32983: Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activities
Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. This vulnerability is fixed in 2024.5.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-32983?
CVE-2024-32983 is considered a high severity vulnerability due to its potential for content spoofing and impersonation.
How do I fix CVE-2024-32983?
To fix CVE-2024-32983, upgrade Misskey to version 2024.5.0 or later.
What is the impact of CVE-2024-32983 on Misskey users?
CVE-2024-32983 allows threat actors to spoof signed ActivityPub activities, which can mislead users and affect trust within the platform.
Can CVE-2024-32983 be exploited remotely?
Yes, CVE-2024-32983 can be exploited remotely, allowing attackers to send malicious signed activities to the Misskey platform.
What versions of Misskey are affected by CVE-2024-32983?
Misskey versions prior to 2024.5.0 are affected by CVE-2024-32983.