Lucene search

matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification

🗓️ 30 Sep 2022 22:50:46Reported by GitHub Advisory DatabaseType

matrix-js-sdk vulnerability in SAS verification flow, leading to user impersonatio

Reporter	Title	Published	Views	Family All 78
Veracode	Authentication Bypass	30 Sep 202206:19	–	veracode
RedhatCVE	CVE-2022-39250	17 Oct 202214:18	–	redhatcve
AlpineLinux	CVE-2022-39250	29 Sep 202213:15	–	alpinelinux
Prion	Cross site scripting	29 Sep 202213:15	–	prion
OSV	matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification	30 Sep 202222:46	–	osv
OSV	CVE-2022-39250	29 Sep 202213:15	–	osv
OSV	MozillaThunderbird-102.3.1-1.1 on GA media	15 Jun 202400:00	–	osv
OSV	element-desktop-1.11.8-1.1 on GA media	15 Jun 202400:00	–	osv
OSV	element-web-1.11.8-1.1 on GA media	15 Jun 202400:00	–	osv
OSV	Important: thunderbird security update	25 Oct 202200:00	–	osv

Vulners

Node

matrix matrix-rust-sdkRange<19.7.0

Source	Link
github	www.github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-5w8r-8pgj-5jmf
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-39250
github	www.github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76
github	www.github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0
matrix	www.matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients
security	www.security.gentoo.org/glsa/202210-35
github	www.github.com/advisories/GHSA-5w8r-8pgj-5jmf

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

30 Sep 2022 22:46Current

8.0High risk

Vulners AI Score8.0

EPSS0.001