Mastodon has improper authorship check on audience extension for existing posts
Résumé
Mastodon has improper authorship check on audience extension for existing posts
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- patch github.com
- web github.com
- web github.com