CVE-2023-42452

Summary

CVE-2023-42452 is a vulnerability affecting versions of the open-source social network server Mastodon, specifically those on the 4.x branch prior to 4.0.10, 4.2.8, and 4.2.0-rc2. This issue allows attackers to exploit the translation feature under certain conditions, bypassing server-side HTML sanitization and executing unescaped HTML in the user's browser. Although the impact is limited due to Mastodon's Content Security Policy, an attacker could potentially exploit a CSP bypass or loophole for malicious XSS. This vulnerability requires user interaction, as it can only be exploited upon clicking the “Translate” button on a malicious post. Versions 4.0.10, 4.2.8, and 4.2.0-rc2 have been released to address this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.