PT-2023-2100 · Unknown+5 · Matrix-Js-Sdk+5

Denis Kasak · Published 2023-03-28 · Updated 2024-06-15 · CVE-2023-28427

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions matrix-js-sdk versions prior to 24.0.0

Description The issue is related to events sent with special strings in key places, which can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. The matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This is a distinct issue from others that may cover similar problems.

Recommendations For versions prior to 24.0.0, upgrade to version 24.0.0 or later to resolve the issue. There are no known workarounds for this vulnerability.

Exploit

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

ALSA-2023:1802

ALSA-2023:1809

BDU:2023-01835

CESA-2023_1802

CESA-2023_1806

CVE-2023-28427

DLA-3400-1

DSA-5392-1

GHSA-MWQ8-FJPF-C2GR

MGASA-2023-0132

OPENSUSE-SU-2024:12823-1

OPENSUSE-SU-2024:12852-1

RHSA-2023:1802

RHSA-2023:1803

RHSA-2023:1804

RHSA-2023:1805

RHSA-2023:1806

RHSA-2023:1809

RHSA-2023:1810

RHSA-2023:1811

RHSA-2023_1802

RHSA-2023_1806

RHSA-2023_1809

RLSA-2023:1802

RLSA-2023:1809

SUSE-SU-2023:1736-1

Affected Products

Almalinux

Centos

Debian

Red Hat

Rocky Linux

Matrix-Js-Sdk

References · 110

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28427.json · Exploit
• https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2gr · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-28427 · Security Note
• https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 · Vendor Advisory
• https://debian.org/security/2023/dsa-5392 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28427 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3400-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2023:1809 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-28427 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12852-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2023:1802 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mwq8-fjpf-c2gr · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2023-12 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-1809.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28427 · Security Note