« Volver al listado

CVE-2025-23197

Estado: AplazadaMedia (6.5)—

matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. When Hookshot 6 version 6.0.1 or below, or Hookshot 5 version 5.4.1 or below, is configured with GitHub support, it is vulnerable to a Denial of Service (DoS) whereby it can crash on restart due to a missing check. The impact is greater to you untrusted users can add their own GitHub organizations to Hookshot in order to connect their room to a repository. This vulnerability is fixed in 6.0.2 and 5.4.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Matrix-hookshot — Matrix-hookshotAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-23197",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-23197",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-27T17:41:28.801479Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "matrix-org",
          "product": "matrix-hookshot",
          "versions": [
            {
              "status": "affected",
              "version": ">= 6.0.0, < 6.0.2"
            },
            {
              "status": "affected",
              "version": "< 5.4.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-01-27T18:15:41.037",
  "references": [
    {
      "url": "https://github.com/matrix-org/matrix-hookshot/commit/e51d8210233ac759e7f7dfebc2c4f1bf6ce94802",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/matrix-org/matrix-hookshot/security/advisories/GHSA-cr4q-jf47-3645",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. When Hookshot 6 version 6.0.1 or below, or Hookshot 5 version 5.4.1 or below, is configured with GitHub support, it is vulnerable to a Denial of Service (DoS) whereby it can crash on restart due to a missing check. The impact is greater to you untrusted users can add their own GitHub organizations to Hookshot in order to connect their room to a repository. This vulnerability is fixed in 6.0.2 and 5.4.2."
    },
    {
      "lang": "es",
      "value": "matrix-hookshot es un bot de Matrix para conectarse a servicios externos como GitHub, GitLab, JIRA y más. Cuando Hookshot 6 versión 6.0.1 o anterior, o Hookshot 5 versión 5.4.1 o anterior, se configura con soporte para GitHub, es vulnerable a una denegación de servicio (DoS) por la cual puede bloquearse al reiniciarse debido a una verificación faltante. El impacto es mayor para los usuarios no confiables que pueden agregar sus propias organizaciones de GitHub a Hookshot para conectar su sala a un repositorio. Esta vulnerabilidad se corrigió en 6.0.2 y 5.4.2."
    }
  ],
  "lastModified": "2026-06-17T08:52:33.540",
  "sourceIdentifier": "security-advisories@github.com"
}