matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue.
References
Configurations
History
21 Nov 2024, 07:54
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv - Vendor Advisory | |
| References | () https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 - Vendor Advisory |
05 Apr 2023, 01:09
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.2 |
| CPE | cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk:*:*:*:*:*:node.js:*:* | |
| First Time |
Matrix-react-sdk Project
Matrix-react-sdk Project matrix-react-sdk |
|
| References | (MISC) https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv - Vendor Advisory | |
| References | (MISC) https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 - Vendor Advisory |
28 Mar 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-28 21:15
Updated : 2024-11-21 07:54
NVD link : CVE-2023-28103
Mitre link : CVE-2023-28103
CVE.ORG link : CVE-2023-28103
JSON object : View
Products Affected
matrix-react-sdk_project
- matrix-react-sdk
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')