CVE-2025-62605

{
  "id": "CVE-2025-62605",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-21T17:15:41.203",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon internally treats reblogs as statuses. Since they were not special-treated, an attacker could reblog any post, then quote their reblog, technically quoting themselves, but having the quote feature a preview of the post they did not get authorization for with all of the affordances that would be otherwise denied by the quote controls. This issue has been patched in versions 4.4.8 and 4.5.0-beta.2."
    },
    {
      "lang": "es",
      "value": "Mastodon es un servidor de red social gratuito y de código abierto basado en ActivityPub. En la versión 4.4 de Mastodon, se añadió soporte para publicaciones de citas verificables con controles de cita, pero es posible que un atacante omita estos controles en versiones de Mastodon anteriores a la 4.4.8 y 4.5.0-beta.2. Mastodon trata internamente los reblogs como estados. Dado que no se les dio un tratamiento especial, un atacante podría hacer reblog de cualquier publicación, luego citar su reblog, técnicamente citándose a sí mismo, pero haciendo que la cita muestre una vista previa de la publicación para la que no obtuvo autorización con todas las funcionalidades que de otro modo serían denegadas por los controles de cita. Este problema ha sido parcheado en las versiones 4.4.8 y 4.5.0-beta.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "mastodon",
          "product": "mastodon",
          "versions": [
            {
              "version": ">= 4.4.0-beta.1, < 4.4.8",
              "status": "affected"
            },
            {
              "version": "= 4.5.0-beta.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-21T17:59:52.795175Z",
          "id": "CVE-2025-62605",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.4.0",
              "versionEndExcluding": "4.4.8",
              "matchCriteriaId": "1E60306E-2AEE-4F99-8430-6075162A4799"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:joinmastodon:mastodon:4.5.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "A3835271-0B04-4DFD-AFA8-4A31AA713B97"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/mastodon/mastodon/commit/2dc4552229b55e2e4adaef675e68ed7ae123d78e",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/mastodon/mastodon/commit/405a49df44033e7d179f3d44d59fb68a67d54789",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/mastodon/mastodon/releases/tag/v4.4.8",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/mastodon/mastodon/releases/tag/v4.5.0-beta.2",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-8h43-rcqj-wpc6",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}