Vulnerabilidades en matrix-org

83 resultados
Análisis Vexday

O ecossistema matrix-org acumula 80 CVEs catalogadas, com 2 classificadas como críticas e nenhuma atualmente registrada no catálogo CISA KEV, posicionando o vendor abaixo da média geral de exploração ativa do catálogo. A ausência de provas de conceito públicas e de novos registros nos últimos 90 dias sugere um ritmo de descoberta baixo no período recente, embora o histórico acumulado mereça acompanhamento contínuo. A falha mais prevalente é do tipo CWE-287 (falhas de autenticação), o que indica uma área estrutural de risco que equipes de segurança devem priorizar em revisões de configuração e controle de acesso. A CVE mais perigosa ativa no momento é CVE-2020-26257, com score EPSS de 0,0236, sinalizando probabilidade de exploração relativamente baixa, mas que não deve ser descartada em ambientes que ainda não aplicaram as correções correspondentes.

CVE-2020-26257MEDIUMDenial of service attack via incorrect parameters to federation APIsEPSS 2.4%CVE-2021-21274MEDIUMDenial of service attack via .well-known lookupsEPSS 2.2%CVE-2021-29430HIGHDenial of service attack via memory exhaustionEPSS 1.8%CVE-2021-21273LOWOpen redirects on some federation and push requestsEPSS 1.8%CVE-2021-29471LOWDenial of service in Matrix SynapseEPSS 1.6%CVE-2021-21393MEDIUMDenial of service (via resource exhaustion) due to improper input validation on groups/communities endpointsEPSS 1.6%CVE-2022-31052MEDIUMURL previews can crash Synapse media repositories or Synapse monolithsEPSS 1.6%CVE-2021-21394MEDIUMDenial of service (via resource exhaustion) due to improper input validation on third-party identifier endpointsEPSS 1.5%CVE-2021-41281HIGHPath traversal in Matrix SynapseEPSS 1.5%CVE-2021-39164LOWImproper authorisation of /members discloses room membership to non-membersEPSS 1.5%CVE-2021-21333MEDIUMHTML injection in email and account expiry notificationsEPSS 1.4%CVE-2021-21332MEDIUMCross-site scripting (XSS) vulnerability in the password reset endpointEPSS 1.2%CVE-2021-29431HIGHSSRF in Sydent due to missing validation of hostnamesEPSS 1.2%CVE-2023-28427HIGHPrototype pollution in matrix-js-sdkEPSS 1.2%CVE-2023-45129MEDIUMmatrix-synapse vulnerable to denial of service due to malicious server ACL eventsEPSS 1.2%CVE-2022-39236MEDIUMMatrix Javascript SDK improper beacon events can cause availability issuesEPSS 1.1%CVE-2022-39249HIGHMatrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessionsEPSS 1.0%CVE-2023-32323MEDIUMSynapse Outgoing federation to specific hosts can be disabled by sending malicious invitesEPSS 1.0%CVE-2022-29166HIGHImproper handling of multiline messages in matrix-appservice-ircEPSS 1.0%CVE-2022-39250HIGHMatrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verificationEPSS 1.0%