CVE-2025-25306
Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes
概要
Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the id and url fields of ActivityPub objects. An attacker can forge an object where they claim authority in the url field even if the specific ActivityPub object type require authority in the id field. Version 2025.2.1 addresses the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com