Incorrect Privilege Assignment Affecting matrix-appservice-irc package, versions <0.35.0
Threat Intelligence
EPSS
0.1% (44th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-MATRIXAPPSERVICEIRC-3022998
- published 14 Sep 2022
- disclosed 14 Sep 2022
- credit Val Lorentz
Introduced: 14 Sep 2022
CVE-2022-39203 Open this link in a new tabHow to fix?
Upgrade matrix-appservice-irc to version 0.35.0 or higher.
Overview
matrix-appservice-irc is an An IRC Bridge for Matrix
Affected versions of this package are vulnerable to Incorrect Privilege Assignment due to improper string characters validation, which makes it possible to provide a maliciously crafted string that would confuse the bridge into combining an attacker-owned channel and an existing channel, which allows granting permissions in the channel.
References
CVSS Scores
version 3.1