CVE-2023-28103 — Prototype Pollution in Matrix-react-sdk

CWE-1321 — Prototype Pollution4 documents4 sources
Severity
8.2HIGHNVD
GHSA5.3OSV5.3
EPSS
0.6%
top 30.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Matrix-org Matrix-react-sdkMatrix-react-sdk Project Matrix-react-sdk
Timeline
PublishedMar 28
Latest updateMar 29

Description

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHS…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:HExploitability: 3.9 | Impact: 4.2

Affected Packages3 packages

▶CVEListV5matrix-org/matrix-react-sdk< 3.69.0

🔴Vulnerability Details

3
OSV
Prototype pollution in matrix-react-sdk↗2023-03-29
▶
GHSA
Prototype pollution in matrix-react-sdk↗2023-03-29
▶
CVEList
Prototype pollution in matrix-react-sdk↗2023-03-28
▶
CVE-2023-28103 — Prototype Pollution | cvebase