CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon
Attackers can bypass authentication attempt restrictions to brute-force user accounts in Mastodon social network instances.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-2166?
CVE-2022-2166 is a critical vulnerability in mastodon/mastodon, published on 16 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.
Weakness: CWE-307
Which versions are affected by CVE-2022-2166?
1 open source package ship an affected version, including mastodon. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mastodon Bitnami | All versions | 3.5.6 |
Products include Joinmastodon Mastodon.
How do I fix CVE-2022-2166?
Upgrade mastodon to 3.5.6 or later.
Is CVE-2022-2166 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2166 exists.
Other vulnerabilities in mastodon/mastodon
- CVE-2023-36460 Mastodon vulnerable to arbitrary file creation through media attachments
- CVE-2022-24307 Missing authorization in n/a
- CVE-2018-21018 Auth bypass in n/a
- CVE-2024-23832 Mastodon Remote user impersonation and takeover
- CVE-2023-36459 Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards
Sources
Also known as BIT-mastodon-2022-2166, GHSA-q5qv-4wvf-4v9h.