3.7
CVE-2023-38700
- EPSS 0.49%
- Veröffentlicht 04.08.2023 19:15:09
- Zuletzt bearbeitet 21.11.2024 08:14:05
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
Loginmatrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms
matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target. Version 1.0.1n fixes this issue. As a workaround, set the `matrixHandler.eventCacheSize` config value to `0`. This workaround may impact performance.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Matrix ≫ Matrix Irc Bridge SwPlatformnode.js Version < 1.0.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.49% | 0.379 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 3.7 | 2.2 | 1.4 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
|
| security-advisories@github.com | 3.5 | 1.8 | 1.4 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1
https://github.com/matrix-org/matrix-appservice-irc/commit/8bbd2b69a16cbcbeffdd9b5c973fd89d61498d75
https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-c7hh-3v6c-fj4q