Skip to main content

Improper Neutralization of Input Terminators

CVE-2024-52505

Medium
5.4/10

Summary

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge versions through 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution like the bridge IRC bot. The vulnerability has been patched in matrix-appservice-irc version 3.0.3.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • LOW
  • LOW
  • NONE

CWE-147 - Improper Neutralization of Input Terminators

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input terminators when they are sent to a downstream component.

References

Advisory Timeline

  • Published