Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `/auth/setup`. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 and 4.3.4 fix the issue.
References
Configurations
Configuration 1 (hide)
|
History
24 Jun 2025, 15:59
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CPE | cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:* | |
| First Time |
Joinmastodon mastodon
Joinmastodon |
|
| References | () https://github.com/mastodon/mastodon/commit/06f879ce9bea195344ac9f71e6799eea500628ec - Patch | |
| References | () https://github.com/mastodon/mastodon/security/advisories/GHSA-v39f-c9jj-8w7h - Vendor Advisory |
27 Feb 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-02-27 17:15
Updated : 2025-06-24 15:59
NVD link : CVE-2025-27157
Mitre link : CVE-2025-27157
JSON object : View
Products Affected
joinmastodon
- mastodon
CWE
CWE-770
Allocation of Resources Without Limits or Throttling