CVE-2023-52077 - CVE House

Back to Database

Status published High CVE-2023-52077

External apps using tokens issued by administrators and moderators can call admin APIs

8.9 CVSS

Vulnerability Description

Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-52077

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from nexryai

View All →

Concorde not removing authentication tokens after logging out

Concorde CSRF vulnerability due to insecure configuration of authentication cookie attributes

Uncontrolled Recursion and Asymmetric Resource Consumption in Altair media/file proxy

nexkey allows arbitrary users to impersonate any remote user due to missing signature validation

Nexkey allows users to bypass authentication of Bull dashboard

Affected Vendor

nexryai

View all reports →

Affected Software

nexkey

Vulnerable Versions:

< 12.23Q4.5

Timeline

Official Publish: December 27th, 2023

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1548 Abuse Elevation Control Mechanism

Privilege Escalation

T1021 Remote Services

Lateral Movement

T1098 Account Manipulation

Defense Evasion