CVE-2023-36462
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Mastodon, a social network server based on ActivityPub, has a vulnerability that allows an attacker to craft a verified profile link that misleads users about the actual URL. Versions from 2.6.0 to prior to 3.5.9, 4.0.5, and 4.1.3 are affected.
Risk Assessment
An attacker can exploit this vulnerability to conduct phishing attacks, posing a risk to users and the organization's reputation.
Recommendation
It is recommended to upgrade to versions 3.5.9, 4.0.5, or 4.1.3, which contain a patch for this vulnerability.
Original NVD description (English source)
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether. The link is visually misleading, but clicking on it will reveal the actual link. This can still be used for phishing, though, similar to IDN homograph attacks. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.