CVE-2023-43805CWE-287

Nexkey allows users to bypass authentication of Bull dashboard

High · published October 4, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
56.0
In the wild
Unconfirmed
What it is

Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00795 · 56.0th percentile
Weakness
CWE-287 · Improper Authentication
Published
2023-10-04T20:24Z
EPSS history
Timeline
  • 04 OCT 20:24Z
    Nexkey allows users to bypass authentication of Bull dashboard
    cvelistv5