CVE-2023-28427 is a high-severity vulnerability affecting versions of the matrix-js-sdk prior to 24.0.0, where specially crafted strings in Matrix events can disrupt or impede the SDK's proper functioning, potentially leading to data exclusion or corruption. With a CVSS score of 8.2, this vulnerability has a network attack vector, low attack complexity, and can result in high availability impact and low integrity impact. There is currently no known active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 24.0.0CPE matchmatch criteria | cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Prototype pollution in matrix-js-sdk (part 2)
Mar 30, 2023High Severity Prototype Pollution Vulnerabilities in matrix-js-sdk and matrix-react-sdk
Mar 29, 2023Prototype Pollution in matrix-js-sdk
Mar 29, 2023High-severity Prototype Pollution vulnerabilities in matrix-js-sdk and matrix-react-sdk
Mar 29, 2023Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack
Mar 28, 2023