CVE-2023-24810

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Misskey is an open source, decentralized social media platform. Due to insufficient validation of the redirect URL during `miauth` authentication in Misskey, arbitrary JavaScript can be executed when a user allows the link. All versions below 13.3.1 (including 12.x) are affected. This has been fixed in version 13.3.1. Users are advised to upgrade. Users unable to upgrade should not allow authentication of untrusted apps.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-248116.1Misskey is an open source, decentralized social media platform. In versions prior to 13.3.2 the URL preview function is subject to a cross s CVE-2023-248129.8Misskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient pa CVE-2023-248139.8Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can CVE-2023-248146.1TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 c CVE-2023-248155.3Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications t CVE-2023-248167.0IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Py CVE-2023-248177.5RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prio CVE-2023-248187.5RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. CVE-2023-248199.8RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. CVE-2023-24827.2The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement,CVE-2023-248207.5RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. CVE-2023-248217.5RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames.