Description
An attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield.
Recommendation
Update the matrix-js-sdk package to the latest compatible version. Followings are version details:
- Affected version(s): < 19.7.0
- Patched version(s): 19.7.0
References
Could your website be exposed too?
SmartScanner can check your website for matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion and gives you actionable findings to investigate.
Start a free scanRelated Issues
- matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification - CVE-2022-39250
- matrix-js-sdk subject to impersonated messages due to permissive key forwarding - CVE-2022-39249
- matrix-js-sdk Prototype Pollution vulnerability - CVE-2022-36059
- Improper beacon events in matrix-js-sdk can result in availability issues - CVE-2022-39236
You might also like:
See something that needs correcting? Let us knowUpdated January 30, 2023