{"id":"CVE-2023-28853","summary":"Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database","details":"Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the attacker can perform LDAP injection attack to leak arbitrary attributes from LDAP database. This issue is fixed in versions 3.5.8, 4.0.4, and 4.1.2.","aliases":["BIT-mastodon-2023-28853","GHSA-38g9-pfm9-gfqv"],"modified":"2026-03-11T15:10:14.272324Z","published":"2023-04-04T21:14:53.350Z","database_specific":{"cna_assigner":"GitHub_M","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28853.json","cwe_ids":["CWE-90"]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/07/06/6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28853.json"},{"type":"WEB","url":"https://github.com/mastodon/mastodon/blob/94cbd808b5b3e7999c7e77dc724b7e8c9dd2bdec/app/models/concerns/ldap_authenticable.rb#L7-L14"},{"type":"WEB","url":"https://github.com/mastodon/mastodon/blob/94cbd808b5b3e7999c7e77dc724b7e8c9dd2bdec/config/initializers/devise.rb#L398-L414"},{"type":"FIX","url":"https://github.com/mastodon/mastodon/pull/24379"},{"type":"WEB","url":"https://github.com/mastodon/mastodon/releases/tag/v3.5.8"},{"type":"WEB","url":"https://github.com/mastodon/mastodon/releases/tag/v4.0.4"},{"type":"WEB","url":"https://github.com/mastodon/mastodon/releases/tag/v4.1.2"},{"type":"ADVISORY","url":"https://github.com/mastodon/mastodon/security/advisories/GHSA-38g9-pfm9-gfqv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28853"},{"type":"WEB"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mastodon/mastodon","events":[{"introduced":"ccc2f608c5c1caac2ea4796f4490f29d59d67068"},{"fixed":"1bd831b9a9d288566ca38045f6410c771946634b"}],"database_specific":{"versions":[{"introduced":"2.5.0"},{"fixed":"3.5.8"}]}},{"type":"GIT","repo":"https://github.com/mastodon/mastodon","events":[{"introduced":"fb389bd73c8a4bc2924496f6041c8eee27572d21"},{"fixed":"214c3670959361230c5199e668df4de3da513b22"}],"database_specific":{"versions":[{"introduced":"4.0.0"},{"fixed":"4.0.4"}]}},{"type":"GIT","repo":"https://github.com/mastodon/mastodon","events":[{"introduced":"61c5dfb9295ea66c376c452a7ef7379e8c562416"},{"fixed":"4b9e4f6398760cc04f9fde2c659f30ffea216e12"}],"database_specific":{"versions":[{"introduced":"4.1.0"},{"fixed":"4.1.2"}]}}],"versions":["v2.5.0","v2.6.0","v2.6.0rc1","v2.6.0rc2","v2.6.0rc3","v2.6.0rc4","v2.6.1","v2.7.0","v2.7.0rc1","v2.7.0rc2","v2.7.0rc3","v2.7.1","v2.8.0","v2.8.0rc1","v2.8.0rc2","v2.8.0rc3","v2.8.1","v2.8.2","v2.9.0","v2.9.0rc1","v2.9.0rc2","v2.9.1","v2.9.2","v3.0.0","v3.0.0rc1","v3.0.0rc2","v3.0.0rc3","v3.0.1","v3.1.0","v3.1.0rc1","v3.1.0rc2","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.2.0","v3.2.0rc1","v3.2.0rc2","v3.3.0","v3.3.0rc1","v3.3.0rc2","v3.3.0rc3","v3.4.0","v3.4.0rc1","v3.4.0rc2","v3.4.1","v3.5.0","v3.5.0rc1","v3.5.0rc2","v3.5.0rc3","v3.5.1","v3.5.2","v3.5.3","v3.5.4","v3.5.5","v3.5.6","v3.5.7","v4.0.0","v4.0.1","v4.0.2","v4.0.3","v4.1.0","v4.1.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-28853.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/tootsuite/mastodon","events":[{"introduced":"ccc2f608c5c1caac2ea4796f4490f29d59d67068"},{"fixed":"1bd831b9a9d288566ca38045f6410c771946634b"},{"introduced":"fb389bd73c8a4bc2924496f6041c8eee27572d21"},{"fixed":"214c3670959361230c5199e668df4de3da513b22"},{"introduced":"61c5dfb9295ea66c376c452a7ef7379e8c562416"},{"fixed":"4b9e4f6398760cc04f9fde2c659f30ffea216e12"}],"database_specific":{"versions":[{"introduced":"2.5.0"},{"fixed":"3.5.8"},{"introduced":"4.0.0"},{"fixed":"4.0.4"},{"introduced":"4.1.0"},{"fixed":"4.1.2"}]}}],"versions":["v2.5.0","v2.6.0","v2.6.0rc1","v2.6.0rc2","v2.6.0rc3","v2.6.0rc4","v2.6.1","v2.7.0","v2.7.0rc1","v2.7.0rc2","v2.7.0rc3","v2.7.1","v2.8.0","v2.8.0rc1","v2.8.0rc2","v2.8.0rc3","v2.8.1","v2.8.2","v2.9.0","v2.9.0rc1","v2.9.0rc2","v2.9.1","v2.9.2","v3.0.0","v3.0.0rc1","v3.0.0rc2","v3.0.0rc3","v3.0.1","v3.1.0","v3.1.0rc1","v3.1.0rc2","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.2.0","v3.2.0rc1","v3.2.0rc2","v3.3.0","v3.3.0rc1","v3.3.0rc2","v3.3.0rc3","v3.4.0","v3.4.0rc1","v3.4.0rc2","v3.4.1","v3.5.0","v3.5.0rc1","v3.5.0rc2","v3.5.0rc3","v3.5.1","v3.5.2","v3.5.3","v3.5.4","v3.5.5","v3.5.6","v3.5.7","v4.0.0","v4.0.0rc1","v4.0.0rc2","v4.0.0rc3","v4.0.0rc4","v4.0.1","v4.0.2","v4.0.3","v4.1.0","v4.1.0rc1","v4.1.0rc2","v4.1.0rc3","v4.1.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-28853.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}]}