Cyber Resilience

CVE-2023-28853

Joinmastodon Mastodon 2.5.0 – 3.5.8

Public PoC
Published
04 April 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 7.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS Score 0.013 67th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2023-28853 is a high-severity LDAP Injection (CWE-90) vulnerability in Joinmastodon Mastodon. Its CVSS base score is 7.7 (High).

Operationally, ranked in the top 33% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability Data

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the…

more

attacker can perform LDAP injection attack to leak arbitrary attributes from LDAP database. This issue is fixed in versions 3.5.8, 4.0.4, and 4.1.2.

CWE(s)
CWE-90CWE-74

Related Threats

CVEs Like This One

CVE-2023-31025Shared CWE-74, CWE-90
CVE-2023-51446Shared CWE-74, CWE-90
CVE-2023-29050Shared CWE-74, CWE-90
CVE-2025-20216Shared CWE-74
CVE-2024-23648Shared CWE-74
CVE-2026-49268Shared CWE-90
CVE-2023-29519Shared CWE-74
CVE-2026-29777Shared CWE-74
CVE-2026-45344Shared CWE-74
CVE-2026-33148Shared CWE-74

Affected Assets

joinmastodon
mastodon
2.5.0 — 3.5.8 · 4.0.0 — 4.0.4 · 4.1.0 — 4.1.2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.2.1
  • V1.2.3
  • V1.2.5
  • V1.2.8

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SA-11 Developer Testing and Evaluation
addresses: CWE-74

Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.

SI-4 System Monitoring
addresses: CWE-74

Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input neutralization and query parameterization to prevent LDAP injection.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development catches LDAP injection via dynamic analysis or fuzzing, but does not prevent it at the source.

A.8.15 Logging partial match
detects

Logging supports detection of injection attempts but does not prevent the weakness.

A.8.16 Monitoring activities partial match
detects

Monitoring activities can identify active injection attacks after they occur.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle mandates input validation and query construction practices that directly prevent LDAP injection.

A.8.26 Application security requirements partial match
prevents

Application security requirements include explicit rules for safe construction of directory queries, mitigating LDAP injection.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles reduce injection surfaces but do not prescribe specific neutralization techniques.

References