Description (CNA)
Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `/auth/setup`. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 and 4.3.4 fix the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| mastodon / mastodon | affected >= 4.2.0, < 4.2.16; affected >= 4.3.0, < 4.3.4 |
CWE
CWE-770
References
- https://github.com/mastodon/mastodon/security/advisories/GHSA-v39f-c9jj-8w7h
- https://github.com/mastodon/mastodon/commit/06f879ce9bea195344ac9f71e6799eea500628ec
ADP enrichment
No English description supplied.
No references supplied.