Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header.

According to its self-reported version number, the Mastodon application running on the remote host is prior to 4.1.17 or 4.2.x prior to 4.2.9. It is, therefore, affected by multiples vulnerabilities :

- Private mention filtering can be bypassed - Missing rate-limit to password change endpoint - Bypassing rate limiting with X-Forwarded-For header

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
114475	Mastodon 4.2.x < 4.2.9 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
114474	Mastodon < 4.1.17 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high

Detections

Analytics

CVE-2023-49952

high

Tenable Plugins

high

high