According to its self-reported version number, the Mastodon application running on the remote host is prior to 3.5.9 or 4.0.x prior to 4.0.5 or 4.1.x prior to 4.1.3. It is, therefore, affected by multiples vulnerabilities :

- Verified profile links can be formatted in a misleading way - Denial of Service through slow HTTP responses - Arbitrary file creation through media attachments - XSS through oEmbed preview cards

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
114491	Mastodon 4.0.x < 4.0.5 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	11/5/2024	11/5/2024	critical
114492	Mastodon 4.1.x < 4.1.3 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	11/5/2024	11/5/2024	critical
114490	Mastodon < 3.5.9 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	11/5/2024	11/5/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical