CVE-2023-24811CWE-79

Cross site scripting (XSS) vulnerability using url preview in Misskey

High · published February 22, 2023

CVSS v3.1
7.1
EPSS
0%
Percentile
33.8
In the wild
Unconfirmed
What it is

Misskey is an open source, decentralized social media platform. In versions prior to 13.3.2 the URL preview function is subject to a cross site scripting vulnerability due to insufficient URL validation. Arbitrary JavaScript is executed when a malicious URL is loaded in the `View in Player` or `View in Window` preview. This has been fixed in version 13.3.2. Users are advised to upgrade. Users unable to upgrade should avoid usage of the `View in Player` or `View in Window` functions.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00406 · 33.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-02-22T19:13Z
EPSS history
Timeline
  • 22 FEB 19:13Z
    Cross site scripting (XSS) vulnerability using url preview in Misskey
    cvelistv5