CVE-2025-24897

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-24897
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24897.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-24897
Aliases
  • GHSA-38w6-vx8g-67pp
Published
2025-02-11T15:20:29.237Z
Modified
2026-04-10T05:23:06.886179Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L CVSS Calculator
Summary
Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes
Details

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. This vulnerability was fixed in 2025.2.0-alpha.0. As a workaround, block all access to the /queue directory with a web application firewall (WAF).

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1275",
        "CWE-352",
        "CWE-614"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24897.json"
}
References

Affected packages

Git / github.com/misskey-dev/misskey

Affected ranges

Type
GIT
Repo
https://github.com/misskey-dev/misskey
Events
Introduced
2375359d129b63988b0658f735e1d9c014c10d71
Fixed
89b461a5da42e6632a60c29796df6fb74d3cafd1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24897.json"

Git / github.com/syuilo/misskey

Affected ranges

Type
GIT
Repo
https://github.com/syuilo/misskey
Events
Introduced
2375359d129b63988b0658f735e1d9c014c10d71
Fixed
b7c3630da991bd0ab75f86c6b95092b161cc8085
Database specific 
{
    "versions": [
        {
            "introduced": "12.109.0"
        },
        {
            "fixed": "2025.2.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24897.json"