Lucene search
Veracode Vulnerability DatabaseVERACODE:37992HistoryNov 14, 2022 - 7:37 a.m.
SQL Injection
2022-11-1407:37:00
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
2
sql injection
pgdatastore
user inputs
arbitrary commands
software
0.002 Low
EPSS
Percentile
52.7%
matrix-appservice-irc is vulnerable to sql injection. The vulnerability exists in getRoomVisibility function in PgDataStore.ts because the user provided inputs are not properly validated which allows an attacker to inject and execute arbitrary SQL commands.
| CPE | Name | Operator | Version |
|---|---|---|---|
| matrix-appservice-irc | le | 0.35.0 | |
| matrix-appservice-irc | le | 0.35.0 |
References
github.com/advisories/GHSA-ffwf-47x2-jpr8
github.com/matrix-org/matrix-appservice-irc/commit/179313a37f06b298150edba3e2b0e5a73c1415e7
github.com/matrix-org/matrix-appservice-irc/pull/1619
github.com/matrix-org/matrix-appservice-irc/releases/tag/0.35.1
github.com/matrix-org/matrix-appservice-irc/releases/tag/0.36.0
vuldb.com/?id.213550
Related
cvelist
cvelist
CVE-2022-3971 matrix-appservice-irc PgDataStore.ts sql injection
2022-11-13 00:00:00
nvd
nvd
CVE-2022-3971
2022-11-13 10:15:09
osv
osv
CVE-2022-3971
2022-11-13 10:15:09
Matrix-appservice-irc vulnerable to sql injection via roomIds argument
2022-11-13 12:00:17
prion
prion
Sql injection
2022-11-13 10:15:00
github
github
Matrix-appservice-irc vulnerable to sql injection via roomIds argument
2022-11-13 12:00:17
cve
cve
CVE-2022-3971
2022-11-13 10:15:09