CVE-2024-25108
CVSS 3.1 Score 9.9 of 10 (high)
Details
Summary
CVE-2024-25108 is a serious vulnerability affecting the open source photo sharing platform Pixelfed. The flaw lies in the insufficient authorization checking mechanism, which allows attackers to gain unintended access to administrative and moderator functionality on affected servers. This issue impacts all versions of Pixelfed between v0.10.4 and v0.11.9. A proof of concept (PoC) for this vulnerability has surfaced, posing a potential threat to local users of a Pixelfed server. While user interaction is required to set up the conditions for exploitation, the attacker can carry out the attack in a delayed manner. Version 0.11.11 of Pixelfed addresses this issue, and users are advised to upgrade immediately. As of now, there are no known workarounds for this vulnerability.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.