UpHeron
All vulnerabilities

Servers and applications

CVE-2023-42450

Server-side request forgery

Severity
High 7.5
Published
19 Sept 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.2.0-rc2
Also known as
GHSA-hcqf-fw2r-52g4
Sources
NVD, Project advisories (GitHub)

Description

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if the server configuration includes `ALLOWED_PRIVATE_ADDRESSES` to allow access to local exploitable…

Affected software

SoftwareAffected versions
MastodonServers and applications · cpe:a:joinmastodon:mastodon
  • Version 4.2.0-beta1
  • Version 4.2.0-beta2
  • Version 4.2.0-beta3
  • Version 4.2.0-rc1
MastodonServers and applications · github:mastodon/mastodon
  • From 4.2.0-beta1 before 4.2.0-rc2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-42450
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-42450
  • GitHub Advisory Database https://github.com/advisories/GHSA-hcqf-fw2r-52g4
  • github.com https://github.com/mastodon/mastodon/security/advisories/GHSA-hcqf-fw2r-52g4