CVE-2024-32983

Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. This vulnerability is fixed in 2024.5.0.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/misskey-dev/misskey/commit/d2a5bb39e344fcb84a24ae60faafe4694b227b88	Patch
https://github.com/misskey-dev/misskey/security/advisories/GHSA-2vxv-pv3m-3wvj	Exploit Vendor Advisory
https://github.com/misskey-dev/misskey/commit/d2a5bb39e344fcb84a24ae60faafe4694b227b88	Patch
https://github.com/misskey-dev/misskey/security/advisories/GHSA-2vxv-pv3m-3wvj	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:*

History

25 Nov 2025, 20:37

Type	Values Removed	Values Added
First Time		Misskey Misskey misskey
CPE		cpe:2.3:a:misskey:misskey::::::::
References	~~() https://github.com/misskey-dev/misskey/commit/d2a5bb39e344fcb84a24ae60faafe4694b227b88 -~~	() https://github.com/misskey-dev/misskey/commit/d2a5bb39e344fcb84a24ae60faafe4694b227b88 - Patch
References	~~() https://github.com/misskey-dev/misskey/security/advisories/GHSA-2vxv-pv3m-3wvj -~~	() https://github.com/misskey-dev/misskey/security/advisories/GHSA-2vxv-pv3m-3wvj - Exploit, Vendor Advisory

Information

Published : 2024-06-03 16:15

Updated : 2025-11-25 20:37

NVD link : CVE-2024-32983

Mitre link : CVE-2024-32983

CVE.ORG link : CVE-2024-32983

JSON object : View

Products Affected

misskey

misskey

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2024-32983", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-06-03T16:15:08.567", "references": [{"url": "https://github.com/misskey-dev/misskey/commit/d2a5bb39e344fcb84a24ae60faafe4694b227b88", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-2vxv-pv3m-3wvj", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://github.com/misskey-dev/misskey/commit/d2a5bb39e344fcb84a24ae60faafe4694b227b88", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-2vxv-pv3m-3wvj", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. This vulnerability is fixed in 2024.5.0."}, {"lang": "es", "value": "Misskey es una plataforma de microblogging descentralizada de c\u00f3digo abierto. Misskey no realiza una normalizaci\u00f3n adecuada en las estructuras JSON de los objetos de actividad entrantes firmados de ActivityPub antes de procesarlos, lo que permite a los actores de amenazas falsificar el contenido de las actividades firmadas y hacerse pasar por los autores de las actividades originales. Esta vulnerabilidad se solucion\u00f3 en 2024.5.0."}], "lastModified": "2025-11-25T20:37:04.547", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2046AAAB-CCA5-4550-94B9-66638A482274", "versionEndExcluding": "2024.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}