PT-2022-24988 · Unknown · Matrix-Appservice-Irc

Jaller94 · Published 2022-11-13 · Updated 2022-11-17 · CVE-2022-3971

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions matrix-appservice-irc versions up to 0.35.1

Description A critical issue affects the file src/datastore/postgres/PgDataStore.ts, where the manipulation of the roomIds argument leads to sql injection. Upgrading to version 0.36.0 addresses this issue.

Recommendations For matrix-appservice-irc versions up to 0.35.1, upgrade to version 0.36.0 to address the issue. As a temporary workaround, consider restricting the manipulation of the roomIds argument to minimize the risk of sql injection.

Fix

Improper Neutralization

SQL injection

Weakness Enumeration

CWE-707

CWE-89

Related Identifiers

CVE-2022-3971

GHSA-FFWF-47X2-JPR8

Affected Products

Matrix-Appservice-Irc

References · 10

• https://github.com/matrix-org/matrix-appservice-irc/pull/1619 · Patch
• https://github.com/matrix-org/matrix-appservice-irc/commit/179313a37f06b298150edba3e2b0e5a73c1415e7 · Patch
• https://osv.dev/vulnerability/CVE-2022-3971 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ffwf-47x2-jpr8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3971 · Security Note
• https://github.com/matrix-org/matrix-appservice-irc · Note
• https://github.com/matrix-org/matrix-appservice-irc/releases/tag/0.36.0 · Note
• https://t.me/cibsecurity/52994 · Telegram Post
• https://t.me/cvenotify/37592 · Telegram Post
• https://vuldb.com/?id.213550 · Note