CVE-2021-39195

Description

Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been fixed in 12.90.0. However, if you are using a proxy, you will need to take additional measures. As a workaround this exploit may be avoided by appropriately restricting access to private networks from the host where the application is running.

Weakness classification

• security-advisories@github.com: CWE-918

Primary references

• security-advisories@github.com — Release Notes, Third Party Advisory
• security-advisories@github.com — Patch, Third Party Advisory
• security-advisories@github.com — Issue Tracking, Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Third Party Advisory