Skip to content
OpenAdvisories

Vendor

mastodon

46 known vulnerabilities.

Products

mastodon 44 mastodon/mastodon 2
All Critical High Medium Low Exploited only Public exploit

46 results · Feed

  • High 7.5
    CVE-2023-36461

    Mastodon vulnerable to Denial of Service through slow HTTP responses

    Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the…

    mastodon mastodon
  • Critical 10.0
    CVE-2023-36460 EPSS 40%

    Mastodon vulnerable to arbitrary file creation through media attachments

    Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary f…

    mastodon mastodon
  • Critical 9.3
    CVE-2023-36459

    Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards

    Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and inclu…

    mastodon mastodon
  • High 7.7
    CVE-2023-28853

    Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database

    Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the …

    mastodon mastodon
  • Critical 9.8
    CVE-2022-2166

    Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon

    Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.

    mastodon mastodon/mastodon
  • High 7.4
    CVE-2022-0432 Scanner template

    Prototype Pollution in mastodon/mastodon

    Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.

    mastodon mastodon/mastodon