CVE-2023-28103

2023-03-2821:15:10

Google

osv.dev

cve-2023-28103

denial of service

data modification

remote servers

software vulnerability

8.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.8%

JSON

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue.

CPENameOperatorVersion
matrix-react-sdkeq0.0.2
matrix-react-sdkeq3.35.0
matrix-react-sdkeq0.14.8
matrix-react-sdkeq3.64.0-rc.1
matrix-react-sdkeq1.0.2-rc.3
matrix-react-sdkeq0.10.6
matrix-react-sdkeq1.0.6-rc.1
matrix-react-sdkeq3.53.0-rc.2
matrix-react-sdkeq2.6.0-rc.1
matrix-react-sdkeq0.13.0-rc.2

Name	Operator	Version
matrix-react-sdk	eq	0.0.2
matrix-react-sdk	eq	3.35.0
matrix-react-sdk	eq	0.14.8
matrix-react-sdk	eq	3.64.0-rc.1
matrix-react-sdk	eq	1.0.2-rc.3
matrix-react-sdk	eq	0.10.6
matrix-react-sdk	eq	1.0.6-rc.1
matrix-react-sdk	eq	3.53.0-rc.2
matrix-react-sdk	eq	2.6.0-rc.1
matrix-react-sdk	eq	0.13.0-rc.2