CVE-2022-39236

Katalog CVE

CVSS 5.3 · Medium EPSS 1,3%

Kerentanan Improper Input Validation pada matrix javascript sdk. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This is patched in matrix-js-sdk v19.7.0. Redacting applicable events, waiting for the sync processor to store data, and restarting the client are possible workarounds. Alternatively, redacting the applicable events and clearing all storage will fix the further perceived issues. Downgrading to an unaffected version, noting that such a version may be subject to other vulnerabilities, will additionally resolve the issue.

Rincian

Terbit di NVD

28 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 70,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76 patch · advisory pihak ketiga
• https://github.com/matrix-org/matrix-spec-proposals/pull/3488 patch · advisory pihak ketiga
• https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0 release notes · advisory pihak ketiga
• https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-hvv8-5v86-r45x advisory pihak ketiga
• https://security.gentoo.org/glsa/202210-35 advisory pihak ketiga