CVE-2022-3971

matrix-appservice-irc PgDataStore.ts sql injection

Severity Score

5.6

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability was found in matrix-appservice-irc up to 0.35.1. It has been declared as critical. This vulnerability affects unknown code of the file src/datastore/postgres/PgDataStore.ts. The manipulation of the argument roomIds leads to sql injection. Upgrading to version 0.36.0 is able to address this issue. The name of the patch is 179313a37f06b298150edba3e2b0e5a73c1415e7. It is recommended to upgrade the affected component. VDB-213550 is the identifier assigned to this vulnerability.

Se encontró una vulnerabilidad en Matrix-appservice-irc hasta 0.35.1. Ha sido declarado crítico. Esta vulnerabilidad afecta a código desconocido del archivo src/datastore/postgres/PgDataStore.ts. La manipulación del argumento roomIds conduce a la inyección de SQL. La actualización a la versión 0.36.0 puede solucionar este problema. El nombre del parche es 179313a37f06b298150edba3e2b0e5a73c1415e7. Se recomienda actualizar el componente afectado. VDB-213550 es el identificador asignado a esta vulnerabilidad.

*Credits: N/A

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-11-13 CVE Reserved
2022-11-13 CVE Published
2024-08-03 CVE Updated
2024-09-01 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-707: Improper Neutralization

CAPEC

References (4)

URL	Tag	Source
https://github.com/matrix-org/matrix-appservice-irc/releases/tag/0.36.0	Release Notes
https://vuldb.com/?id.213550	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/matrix-org/matrix-appservice-irc/commit/179313a37f06b298150edba3e2b0e5a73c1415e7	2023-11-07
https://github.com/matrix-org/matrix-appservice-irc/pull/1619	2023-11-07

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Matrix Search vendor "Matrix"		Matrix Irc Bridge Search vendor "Matrix" for product "Matrix Irc Bridge"				<= 0.36.0 Search vendor "Matrix" for product "Matrix Irc Bridge" and version " <= 0.36.0"		node.js		Affected