GitHub Advisoryadvisory · npm

GHSA-ffwf-47x2-jpr8 Matrix-appservice-irc vulnerable to sql injection via roomIds argument

MEDIUM Published 2022-11-13 Modified 2022-11-17 Official page ↗
Aliases
CVE-2022-3971
Ecosystem
npm
Packages
matrix-appservice-irc
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-89
Reviewed
2022-11-15

Affected packages

• npm matrix-appservice-irc: < 0.36.0 → fixed in 0.36.0

Description

A vulnerability was found in matrix-appservice-irc up to 0.35.1. This vulnerability affects the file src/datastore/postgres/PgDataStore.ts. The manipulation of the argument roomIds leads to sql injection. Upgrading to version 0.36.0 is able to address this issue. The name of the patch is 179313a37f06b298150edba3e2b0e5a73c1415e7. It is recommended to upgrade the affected component.

Related

Alias · CVE (1)

  • CVE-2022-3971 A vulnerability was found in matrix-appservice-irc up to 0.35.1. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References