PT-2023-26565
CVE-2023-38700
·
Published
2023-08-04
·
Updated
2023-08-11
Description by
CVSS 3.1
3.5
LowMetricsAV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
matrix-appservice-irc versions prior to 1.0.1
Description
The issue allows an attacker to craft an event that leaks part of a targeted message event from another bridged room, requiring knowledge of an event ID to target.
Recommendations
For versions prior to 1.0.1, upgrade to version 1.0.1.
As a temporary workaround, consider setting the
matrixHandler.eventCacheSize config value to 0, although this may impact performance.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾