CVSS 3.1 Score 7.1 of 10 (high)


Published Feb 19, 2024
Updated: Feb 20, 2024
CWE ID 434


CVE-2024-25636 is a vulnerability in Misskey, an open source social media platform with ActivityPub support. Versions prior to 2024.2.0 do not check the Content-Type header value when fetching remote Activity Streams objects, allowing a threat actor to upload a crafted Activity Streams document to a remote server. If the server accepts arbitrary user uploads and serves them in response to requests with an Accept header value of the Activity Streams media type, the threat actor can impersonate and take over an account on that server. The vulnerability poses a high risk to organizations as it allows unauthorized access and control over accounts. The issue has been patched in version 2024.2.0, providing remediation for the vulnerability.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-25636 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options