CVE-2024-23649

Summary

CVE-2024-23649 is a vulnerability affecting the Lemmy link aggregator and forum used in the fediverse. In versions 0.17.0 through 0.19.0, users, including those without sending or receiving privileges, can report private messages, leading to the exposure of the entire content of the private message. This issue arises due to the unvalidated API response that includes the private message itself. An instance admin can also exploit this vulnerability if the private message is removed from the response. The required privileges to exploit this vulnerability depend on the instance configuration. The vulnerability has been patched in version 0.19.1, and a workaround or blocking the API route in the reverse proxy can be implemented as a temporary measure until the update is applied.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.