CVE-2022-39202: falha de média gravidade em matrix-org matrix-appservice-irc
IRC mode parameter confusion in matrix-appservice-irc
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.9%
matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such modes incorrectly, potentially resulting in the wrong user being given permissions. Mode commands can only be executed by privileged users, so this can only be abused if an operator is tricked into running the command on behalf of an attacker. The vulnerability has been patched in matrix-appservice-irc 0.35.0. As a workaround users should refrain from entering mode commands suggested by untrusted users. Avoid using multiple modes in a single command.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Produtos afetados
matrix-org · matrix-appservice-ircCVEs relacionadas — matrix-org matrix-appservice-irc
No mesmo produto, das mais perigosas para as menos.
CVE-2022-29166HIGHImproper handling of multiline messages in matrix-appservice-ircEPSS 1.0%CVE-2022-39203HIGHParsing issue in matrix-org/node-irc leading to room takeoversEPSS 0.9%CVE-2023-38690MEDIUMmatrix-appservice-irc IRC command injection via admin commands containing newlines EPSS 0.9%CVE-2023-38700LOWmatrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged roomsEPSS 0.6%CVE-2024-39691MEDIUMMalicious Matrix homeserver can leak truncated message content of messages it shouldn't have access toEPSS 0.5%CVE-2024-32000MEDIUMTruncated content of messages can be leaked from matrix-appservice-ircEPSS 0.5%