Moderate severityNVD Advisory· Published Nov 13, 2022· Updated Apr 15, 2025
matrix-appservice-irc PgDataStore.ts sql injection
CVE-2022-3971
Description
A vulnerability was found in matrix-appservice-irc up to 0.35.1. It has been declared as critical. This vulnerability affects unknown code of the file src/datastore/postgres/PgDataStore.ts. The manipulation of the argument roomIds leads to sql injection. Upgrading to version 0.36.0 is able to address this issue. The name of the patch is 179313a37f06b298150edba3e2b0e5a73c1415e7. It is recommended to upgrade the affected component. VDB-213550 is the identifier assigned to this vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
matrix-appservice-ircnpm | < 0.36.0 | 0.36.0 |
Affected products
2- unspecified/matrix-appservice-ircv5Range: 0.35.0
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-ffwf-47x2-jpr8ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-3971ghsaADVISORY
- github.com/matrix-org/matrix-appservice-irc/commit/179313a37f06b298150edba3e2b0e5a73c1415e7ghsaWEB
- github.com/matrix-org/matrix-appservice-irc/pull/1619ghsaWEB
- github.com/matrix-org/matrix-appservice-irc/releases/tag/0.36.0ghsaWEB
- vuldb.comghsaWEB
News mentions
0No linked articles in our index yet.