CVE-2023-49095

Summary

nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2.

Affected Software

Weaknesses

• CWE-20: CWE-20: Improper Input Validation

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/nexryai/nexkey/security/advisories/GHSA-fpxw-rw9v-2gmx
• https://github.com/nexryai/nexkey/commit/b96da0eac5a1e75abba94cf926f1251842829bab

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/nexryai/nexkey/security/advisories/GHSA-fpxw-rw9v-2gmx
• https://github.com/nexryai/nexkey/commit/b96da0eac5a1e75abba94cf926f1251842829bab

• ←Previous
• Next→