Lucene search
Veracode Vulnerability DatabaseVERACODE:37027HistorySep 14, 2022 - 8:01 a.m.
Privilege Escalation
2022-09-1408:01:30
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
12
software vulnerability dynamicchannels.enabled attacker-owned channels
EPSS
0.001
Percentile
42.8%
matrix-appservice-irc is vulnerable to privilege escalation. The vulnerability exists because the dynamic channel joining via dynamicChannels.enabled is not properly disabled which allows an attacker to grant themselves permissions and combine attacker-owned channels with existing channels.
References
github.com/matrix-org/matrix-appservice-irc/commit/9a75c32cb23721e221039f49e9a181224fd066b3
github.com/matrix-org/matrix-appservice-irc/pull/1604
github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-xvqg-mv25-rwvw
matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity
matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity/
Related
osv
osv
Parsing issue in matrix-org/node-irc leading to room takeovers
2022-09-15 03:26:10
CVE-2022-39203
2022-09-13 19:15:13
prion
prion
Design/Logic Flaw
2022-09-13 19:15:00
cve
cve
CVE-2022-39203
2022-09-13 19:15:13
cvelist
cvelist
github
github
Parsing issue in matrix-org/node-irc leading to room takeovers
2022-09-15 03:26:10
nvd
nvd
CVE-2022-39203
2022-09-13 19:15:13