CVE-2022-48364 Information disclosure in n/a
Mastodon moderators' identities are disclosed when approving sensitive status appeals due to missing representative account usage.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-48364?
CVE-2022-48364 is a medium-severity vulnerability in n/a, published on 6 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was marked as sensitive.
Weakness: CWE-287
Which versions are affected by CVE-2022-48364?
1 open source package ship an affected version, including mastodon. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mastodon Bitnami | From 3.5.0 | 3.5.3 |
Products include Joinmastodon Mastodon.
How do I fix CVE-2022-48364?
Upgrade mastodon to 3.5.3 or later.
Is CVE-2022-48364 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-48364 exists.
Other vulnerabilities in n/a
- CVE-2023-36460 Mastodon vulnerable to arbitrary file creation through media attachments
- CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon
- CVE-2022-24307 Missing authorization in n/a
- CVE-2018-21018 Auth bypass in n/a
- CVE-2024-23832 Mastodon Remote user impersonation and takeover
Sources
Also known as BIT-mastodon-2022-48364, GHSA-mjfv-7q85-fj8m.