CVE-2023-49079

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
misskey-dev	misskey	< 2023.11.1-beta.1

References

https://github.com/misskey-dev/misskey/security/advisories/GHSA-3f39-6537-3cgcMitigation, Vendor Advisory
https://github.com/misskey-dev/misskey/security/advisories/GHSA-3f39-6537-3cgcMitigation, Vendor Advisory

Timeline

Published: Nov 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-49084.3Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI vi CVE-2023-490804.3The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter noteboo CVE-2023-490815.3aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modi CVE-2023-490825.3aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to mod CVE-2023-490837.5cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates CVE-2023-490848.8Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the dete CVE-2023-490858.8Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary S CVE-2023-490865.4Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in v CVE-2023-490877.5xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash CVE-2023-490884.8Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incom CVE-2023-490896.5Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffi CVE-2023-49094.3Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via