CVE-2022-2166

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-2166
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-2166.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-2166
Aliases
Published
2022-11-16T00:00:00Z
Modified
2026-10-21T02:30:45Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon
Details

Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.

Database specific 
{
    "cna_assigner":  "@huntrdev",
    "cwe_ids":  [
        "CWE-307"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2166.json"
}
References

Affected packages

Git / github.com/mastodon/mastodon

Affected ranges

Type
GIT
Repo
https://github.com/mastodon/mastodon
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
696f7b360882e71ff45b6ddafc8eea17184a0f31
Introduced
58fc889c6fe697da4f880cb43e75d97d3a604d79
Fixed
21fd25a269cca742af431f0d13299e139f267346
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "3.5.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:joinmastodon:mastodon:4.0.0:rc1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0.0-rc1"
                },
                {
                    "last_affected":  "4.0.0-rc1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:joinmastodon:mastodon:4.0.0:rc2:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0.0-rc2"
                },
                {
                    "last_affected":  "4.0.0-rc2"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:joinmastodon:mastodon:4.0.0:rc3:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0.0-rc3"
                },
                {
                    "last_affected":  "4.0.0-rc3"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:joinmastodon:mastodon:4.0.0:rc4:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0.0-rc4"
                },
                {
                    "last_affected":  "4.0.0-rc4"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "range":  [
                {
                    "fixed":  "21fd25a269cca742af431f0d13299e139f267346"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

4.*
4.0.0-rc1
4.0.0-rc2
4.0.0-rc3
4.0.0-rc4
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.6
v0.7
v0.8
v0.9
v0.9.9
v1.*
v1.0
v1.1
v1.1.1
v1.1.2
v1.2
v1.2.1
v1.2.2
v1.3
v1.3.1
v1.3.2
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4rc1
v1.4rc2
v1.4rc3
v1.4rc4
v1.4rc5
v1.4rc6
v1.5.0
v1.5.0rc1
v1.5.0rc2
v1.5.0rc3
v1.5.1
v1.6.0
v1.6.0rc1
v1.6.0rc2
v1.6.0rc3
v1.6.0rc4
v1.6.0rc5
v1.6.1
v2.*
v2.0.0
v2.0.0rc1
v2.0.0rc2
v2.0.0rc3
v2.0.0rc4
v2.1.0
v2.1.0rc1
v2.1.0rc2
v2.1.0rc3
v2.1.0rc4
v2.1.0rc5
v2.1.0rc6
v2.1.1
v2.1.2
v2.1.3
v2.2.0
v2.2.0rc1
v2.2.0rc2
v2.3.0
v2.3.0rc1
v2.3.0rc2
v2.3.0rc3
v2.3.1
v2.3.1rc1
v2.3.1rc2
v2.3.1rc3
v2.3.2
v2.3.2rc1
v2.3.2rc2
v2.3.2rc3
v2.3.2rc4
v2.3.2rc5
v2.4.0
v2.4.0rc1
v2.4.0rc2
v2.4.0rc3
v2.4.0rc4
v2.4.0rc5
v2.4.1
v2.4.1rc1
v2.4.1rc2
v2.4.1rc3
v2.4.1rc4
v2.4.2
v2.4.2rc1
v2.4.2rc2
v2.4.2rc3
v2.4.3
v2.4.3rc1
v2.4.3rc2
v2.4.3rc3
v2.5.0
v2.5.0rc1
v2.5.0rc2
v2.6.0
v2.6.0rc1
v2.6.0rc2
v2.6.0rc3
v2.6.0rc4
v2.6.1
v2.7.0
v2.7.0rc1
v2.7.0rc2
v2.7.0rc3
v2.7.1
v2.8.0
v2.8.0rc1
v2.8.0rc2
v2.8.0rc3
v2.8.1
v2.8.2
v2.9.0
v2.9.0rc1
v2.9.0rc2
v2.9.1
v2.9.2
v3.*
v3.0.0
v3.0.0rc1
v3.0.0rc2
v3.0.0rc3
v3.0.1
v3.1.0
v3.1.0rc1
v3.1.0rc2
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.2.0
v3.2.0rc1
v3.2.0rc2
v3.3.0
v3.3.0rc1
v3.3.0rc2
v3.3.0rc3
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.1
v3.5.0
v3.5.0rc1
v3.5.0rc2
v3.5.0rc3
v3.5.1
v3.5.2
v3.5.3
v3.5.4
v3.5.5
v4.*
v4.0.0rc1
v4.0.0rc2
v4.0.0rc3
v4.0.0rc4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-2166.json"