CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-32659

Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier, if a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a new `Bridge` instance.), any `m.room.tombstone` event it encounters will be used to unbridge the current room and bridge into the target room. However, the target room `m.room.create` event is not checked to verify if the `predecessor` field contains the previous room. This means that any malicious admin of a bridged room can repoint the traffic to a different room without the new room being aware. Versions 2.6.1 and greater are patched. As a workaround, disabling the automatic room upgrade handling can be done by removing the `roomUpgradeOpts` key from the `Bridge` class options.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 50.1%

CVSS Severity

CVSS v3 Score 6.5

CVSS v2 Score 3.5

References

Products affected by CVE-2021-32659

Matrix » Matrix-Appservice-Bridge » Version: N/A

cpe:2.3:a:matrix:matrix-appservice-bridge:-
Matrix » Matrix-Appservice-Bridge » Version: 0.1.0

cpe:2.3:a:matrix:matrix-appservice-bridge:0.1.0
Matrix » Matrix-Appservice-Bridge » Version: 0.1.1

cpe:2.3:a:matrix:matrix-appservice-bridge:0.1.1
Matrix » Matrix-Appservice-Bridge » Version: 0.1.2

cpe:2.3:a:matrix:matrix-appservice-bridge:0.1.2
Matrix » Matrix-Appservice-Bridge » Version: 0.1.3

cpe:2.3:a:matrix:matrix-appservice-bridge:0.1.3
Matrix » Matrix-Appservice-Bridge » Version: 0.1.4

cpe:2.3:a:matrix:matrix-appservice-bridge:0.1.4
Matrix » Matrix-Appservice-Bridge » Version: 0.1.5

cpe:2.3:a:matrix:matrix-appservice-bridge:0.1.5
Matrix » Matrix-Appservice-Bridge » Version: 0.3.2

cpe:2.3:a:matrix:matrix-appservice-bridge:0.3.2
Matrix » Matrix-Appservice-Bridge » Version: 0.3.3

cpe:2.3:a:matrix:matrix-appservice-bridge:0.3.3
Matrix » Matrix-Appservice-Bridge » Version: 0.3.4

cpe:2.3:a:matrix:matrix-appservice-bridge:0.3.4
Matrix » Matrix-Appservice-Bridge » Version: 0.3.5

cpe:2.3:a:matrix:matrix-appservice-bridge:0.3.5
Matrix » Matrix-Appservice-Bridge » Version: 0.3.6

cpe:2.3:a:matrix:matrix-appservice-bridge:0.3.6
Matrix » Matrix-Appservice-Bridge » Version: 1.0.0

cpe:2.3:a:matrix:matrix-appservice-bridge:1.0.0
Matrix » Matrix-Appservice-Bridge » Version: 1.0.1

cpe:2.3:a:matrix:matrix-appservice-bridge:1.0.1
Matrix » Matrix-Appservice-Bridge » Version: 1.1.1

cpe:2.3:a:matrix:matrix-appservice-bridge:1.1.1
Matrix » Matrix-Appservice-Bridge » Version: 1.10.0

cpe:2.3:a:matrix:matrix-appservice-bridge:1.10.0
Matrix » Matrix-Appservice-Bridge » Version: 1.10.1

cpe:2.3:a:matrix:matrix-appservice-bridge:1.10.1
Matrix » Matrix-Appservice-Bridge » Version: 1.10.2

cpe:2.3:a:matrix:matrix-appservice-bridge:1.10.2
Matrix » Matrix-Appservice-Bridge » Version: 1.10.3

cpe:2.3:a:matrix:matrix-appservice-bridge:1.10.3
Matrix » Matrix-Appservice-Bridge » Version: 1.11.0

cpe:2.3:a:matrix:matrix-appservice-bridge:1.11.0
Matrix » Matrix-Appservice-Bridge » Version: 1.11.1

cpe:2.3:a:matrix:matrix-appservice-bridge:1.11.1
Matrix » Matrix-Appservice-Bridge » Version: 1.12.0

cpe:2.3:a:matrix:matrix-appservice-bridge:1.12.0
Matrix » Matrix-Appservice-Bridge » Version: 1.12.1

cpe:2.3:a:matrix:matrix-appservice-bridge:1.12.1
Matrix » Matrix-Appservice-Bridge » Version: 1.12.2

cpe:2.3:a:matrix:matrix-appservice-bridge:1.12.2
Matrix » Matrix-Appservice-Bridge » Version: 1.13.0

cpe:2.3:a:matrix:matrix-appservice-bridge:1.13.0
Matrix » Matrix-Appservice-Bridge » Version: 1.13.1

cpe:2.3:a:matrix:matrix-appservice-bridge:1.13.1
Matrix » Matrix-Appservice-Bridge » Version: 1.13.2

cpe:2.3:a:matrix:matrix-appservice-bridge:1.13.2
Matrix » Matrix-Appservice-Bridge » Version: 1.14.0

cpe:2.3:a:matrix:matrix-appservice-bridge:1.14.0
Matrix » Matrix-Appservice-Bridge » Version: 1.2.1

cpe:2.3:a:matrix:matrix-appservice-bridge:1.2.1
Matrix » Matrix-Appservice-Bridge » Version: 1.3.0

cpe:2.3:a:matrix:matrix-appservice-bridge:1.3.0
Matrix » Matrix-Appservice-Bridge » Version: 1.3.3

cpe:2.3:a:matrix:matrix-appservice-bridge:1.3.3
Matrix » Matrix-Appservice-Bridge » Version: 1.3.4

cpe:2.3:a:matrix:matrix-appservice-bridge:1.3.4
Matrix » Matrix-Appservice-Bridge » Version: 1.3.5

cpe:2.3:a:matrix:matrix-appservice-bridge:1.3.5
Matrix » Matrix-Appservice-Bridge » Version: 1.3.6

cpe:2.3:a:matrix:matrix-appservice-bridge:1.3.6
Matrix » Matrix-Appservice-Bridge » Version: 1.4.0

cpe:2.3:a:matrix:matrix-appservice-bridge:1.4.0
Matrix » Matrix-Appservice-Bridge » Version: 1.5.0

cpe:2.3:a:matrix:matrix-appservice-bridge:1.5.0
Matrix » Matrix-Appservice-Bridge » Version: 1.6.0

cpe:2.3:a:matrix:matrix-appservice-bridge:1.6.0
Matrix » Matrix-Appservice-Bridge » Version: 1.6.1

cpe:2.3:a:matrix:matrix-appservice-bridge:1.6.1
Matrix » Matrix-Appservice-Bridge » Version: 1.7.0

cpe:2.3:a:matrix:matrix-appservice-bridge:1.7.0
Matrix » Matrix-Appservice-Bridge » Version: 1.8.1

cpe:2.3:a:matrix:matrix-appservice-bridge:1.8.1
Matrix » Matrix-Appservice-Bridge » Version: 1.9.0

cpe:2.3:a:matrix:matrix-appservice-bridge:1.9.0
Matrix » Matrix-Appservice-Bridge » Version: 1.9.1

cpe:2.3:a:matrix:matrix-appservice-bridge:1.9.1
Matrix » Matrix-Appservice-Bridge » Version: 1.9.2

cpe:2.3:a:matrix:matrix-appservice-bridge:1.9.2
Matrix » Matrix-Appservice-Bridge » Version: 2.0.0

cpe:2.3:a:matrix:matrix-appservice-bridge:2.0.0
Matrix » Matrix-Appservice-Bridge » Version: 2.1.0

cpe:2.3:a:matrix:matrix-appservice-bridge:2.1.0
Matrix » Matrix-Appservice-Bridge » Version: 2.2.0

cpe:2.3:a:matrix:matrix-appservice-bridge:2.2.0
Matrix » Matrix-Appservice-Bridge » Version: 2.3.0

cpe:2.3:a:matrix:matrix-appservice-bridge:2.3.0
Matrix » Matrix-Appservice-Bridge » Version: 2.3.1

cpe:2.3:a:matrix:matrix-appservice-bridge:2.3.1
Matrix » Matrix-Appservice-Bridge » Version: 2.4.0

cpe:2.3:a:matrix:matrix-appservice-bridge:2.4.0
Matrix » Matrix-Appservice-Bridge » Version: 2.4.1

cpe:2.3:a:matrix:matrix-appservice-bridge:2.4.1
Matrix » Matrix-Appservice-Bridge » Version: 2.5.0

cpe:2.3:a:matrix:matrix-appservice-bridge:2.5.0
Matrix » Matrix-Appservice-Bridge » Version: 2.6.0

cpe:2.3:a:matrix:matrix-appservice-bridge:2.6.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-32659

Products

Pricing

Contact Us