« Volver al listado

CVE-2024-52505

Estado: AplazadaMedia (5.4)—

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in matrix-appservice-irc version 3.0.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Matrix — Appservice-ircAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-52505",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-52505",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-14T15:54:32.294882Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "matrix-org",
          "product": "matrix-appservice-irc",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.0.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-11-14T16:15:20.220",
  "references": [
    {
      "url": "https://github.com/matrix-org/matrix-appservice-irc/commit/4a024eae1a992b1ea67e71a998e0b833b54221e2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-c3hj-hg7p-rrq5",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-147"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in matrix-appservice-irc version 3.0.3."
    },
    {
      "lang": "es",
      "value": "matrix-appservice-irc es un puente IRC de Node.js para el protocolo de mensajería Matrix. La API de aprovisionamiento del puente matrix-appservice-irc hasta la versión 3.0.2 contiene una vulnerabilidad que puede provocar la ejecución arbitraria de comandos IRC como bot de puente IRC. La vulnerabilidad ha sido corregida en la versión 3.0.3 de matrix-appservice-irc."
    }
  ],
  "lastModified": "2026-06-17T08:07:21.023",
  "sourceIdentifier": "security-advisories@github.com"
}