CVE-2025-24897

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-24897
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24897.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-24897
Aliases
  • GHSA-38w6-vx8g-67pp
Published
2025-02-11T15:20:29Z
Modified
2026-10-21T02:30:40Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L CVSS Calculator
Summary
Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes
Details

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. This vulnerability was fixed in 2025.2.0-alpha.0. As a workaround, block all access to the /queue directory with a web application firewall (WAF).

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1275",
        "CWE-352",
        "CWE-614"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24897.json"
}
References

Affected packages

Git / github.com/misskey-dev/misskey

Affected ranges

Type
GIT
Repo
https://github.com/misskey-dev/misskey
Events
Introduced
2375359d129b63988b0658f735e1d9c014c10d71
Fixed
b7c3630da991bd0ab75f86c6b95092b161cc8085
Fixed
77e421029cb564a97f42b6e41c9edce49f79cecd
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "12.109.0"
                },
                {
                    "fixed":  "2025.2.0"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "77e421029cb564a97f42b6e41c9edce49f79cecd"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24897.json"