CVE-2023-43793: Improper Authentication

October 4, 2023 (updated October 11, 2023)

Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds.

References

github.com/misskey-dev/misskey/commit/c9aeccb2ab260ceedc126e6e366da8cd13ece4b2
github.com/misskey-dev/misskey/security/advisories/GHSA-9fj2-gjcf-cqqc
github.com/nexryai/nexkey/security/advisories/GHSA-g8w5-568f-ffwf
nvd.nist.gov/vuln/detail/CVE-2023-43793

Code Behaviors & Features

Detect and mitigate CVE-2023-43793 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →