CVE-2024-37903

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-37903
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37903.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-37903
Aliases
Published
2024-07-05T17:24:49Z
Modified
2026-10-21T02:30:52Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Mastodon has improper authorship check on audience extension for existing posts
Details

Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37903.json"
}
References

Affected packages

Git / github.com/mastodon/mastodon

Affected ranges

Type
GIT
Repo
https://github.com/mastodon/mastodon
Events
Introduced
50ce347ef96690767b21ee01d6a785166c583b6b
Fixed
ff90ebffaa80bb48d12a838d9a4f82fa7edb602b
Introduced
4fcc026f0f1b12a9de21a3af33375a9c8867dd55
Fixed
a5b4a2b7e71aedd2f04bc7a90f79dfe234fa7f89
Fixed
a1c7aae28aecf06659c5b18cfa131b37cd1512a3
Fixed
d4bf22b632ea8b1174375c4966a6768ab66393b6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.6.0"
                },
                {
                    "fixed":  "4.1.18"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.2.0"
                },
                {
                    "fixed":  "4.2.10"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "a1c7aae28aecf06659c5b18cfa131b37cd1512a3"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "d4bf22b632ea8b1174375c4966a6768ab66393b6"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v4.1.18",
            "range":  [
                {
                    "fixed":  "ff90ebffaa80bb48d12a838d9a4f82fa7edb602b"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v4.2.10",
            "range":  [
                {
                    "fixed":  "a5b4a2b7e71aedd2f04bc7a90f79dfe234fa7f89"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2.*
v2.6.0
v2.6.1
v2.7.0
v2.7.0rc1
v2.7.0rc2
v2.7.0rc3
v2.7.1
v2.8.0
v2.8.0rc1
v2.8.0rc2
v2.8.0rc3
v2.8.1
v2.8.2
v2.9.0
v2.9.0rc1
v2.9.0rc2
v2.9.1
v2.9.2
v3.*
v3.0.0
v3.0.0rc1
v3.0.0rc2
v3.0.0rc3
v3.0.1
v3.1.0
v3.1.0rc1
v3.1.0rc2
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.2.0
v3.2.0rc1
v3.2.0rc2
v3.3.0
v3.3.0rc1
v3.3.0rc2
v3.3.0rc3
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.1
v3.5.0
v3.5.0rc1
v3.5.0rc2
v3.5.0rc3
v3.5.1
v3.5.2
v3.5.3
v4.*
v4.0.0
v4.0.0rc1
v4.0.0rc2
v4.0.0rc3
v4.0.0rc4
v4.0.1
v4.0.2
v4.1.0
v4.1.0rc1
v4.1.0rc2
v4.1.0rc3
v4.1.1
v4.1.10
v4.1.11
v4.1.12
v4.1.13
v4.1.14
v4.1.15
v4.1.16
v4.1.17
v4.1.2
v4.1.3
v4.1.4
v4.1.5
v4.1.6
v4.1.7
v4.1.8
v4.1.9
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.2.6
v4.2.7
v4.2.8
v4.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37903.json"