CVE-2023-38700 is a low-severity information disclosure vulnerability affecting matrix-appservice-irc, a Node.js IRC bridge for Matrix, prior to version 1.0.1. An attacker could craft an event to leak partial message content from another bridged room if they knew a targeted event ID. The CVSS score is 3.7 (LOW) due to its limited impact (partial confidentiality loss) and high attack complexity, requiring specific knowledge. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.0.1CPE matchmatch criteria | cpe:2.3:a:matrix:matrix_irc_bridge:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms
Aug 4, 2023Events can be crafted to leak parts of targeted messages from other bridged rooms
Jul 26, 2023Multiple High Severity Vulnerabilities in Matrix Bridges
Jul 12, 2023Security Updates for Matrix Bridges: OpenID Token Exchange, IRC Command Injection, and Message Leak Vulnerabilities
Jul 10, 2023