Em resumo
- CVE-2022-29166 é uma vulnerabilidade ALTO (CVSS 8.8) que afeta matrix irc bridge (matrix), matrix-appservice-irc.
- Chance de exploração nos próximos 30 dias (EPSS): 1.0%, maior que 63.0% das vulnerabilidades.
- Correção: atualize para 0.33.2 ou posterior.
Description
matrix-appservice-irc provides an IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. In terms of a workaround, users should refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms.
NVD description
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms. There are no known workarounds for this issue.
Mais vulnerabilidades de matrix irc bridge
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free