CVE-2023-36462

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether. The link is visually misleading, but clicking on it will reveal the actual link. This can still be used for phishing, though, similar to IDN homograph attacks. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jul 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-364636.1Meldekarten generator is an open source project to create a program, running locally in the browser without the need for an internet-connect CVE-2023-364645.5pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__par CVE-2023-364657.1Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and CVE-2023-364664.3Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic titl CVE-2023-364678.8AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 CVE-2023-364688.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgra CVE-2023-364698.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own use CVE-2023-36474.8The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege us CVE-2023-364708.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing CVE-2023-364715.4Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6R CVE-2023-364725.7Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset pas CVE-2023-364736.1Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass