« Volver al listado

CVE-2025-24024

Estado: AplazadaCrítica (9.1)—

Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration components if enabled. Version 1.9.1 reverts the feature that introduced the bug, and version 1.9.2 reintroduces the feature safely. Downgrading to version 1.8.3 is recommended if upgrading to 1.9.1 or higher isn't possible.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Bot Matrix accesible remotamente sin autenticación (AV:N/PR:N/UI:N) permite a usuarios no autorizados ejecutar comandos administrativos. CWE-671 (falta de control de acceso) y vector CVSS crítico (I:H/A:H) indican acceso a funciones administrativas del servidor.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementMulti-factor AuthenticationVulnerability ScanningUser Account ManagementPassword PoliciesNetwork Segmentation

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Mjolnir — MjolnirAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-24024",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24024",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-21T19:32:12.739437Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "matrix-org",
          "product": "mjolnir",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.9.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-01-21T20:15:46.617",
  "references": [
    {
      "url": "https://github.com/matrix-org/mjolnir/commit/b437fa16b5425985715df861987c836affd51eea",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/matrix-org/mjolnir/commit/d0ef527a9e3eb45e17143d5295a64b775ccaa23d",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/matrix-org/mjolnir/security/advisories/GHSA-3jq6-xc85-m394",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-671"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration components if enabled. Version 1.9.1 reverts the feature that introduced the bug, and version 1.9.2 reintroduces the feature safely. Downgrading to version 1.8.3 is recommended if upgrading to 1.9.1 or higher isn't possible."
    },
    {
      "lang": "es",
      "value": "Mjolnir es una herramienta de moderación para Matrix. Mjolnir v1.9.0 responde a los comandos de administración desde cualquier sala de la que sea miembro el bot. Esto puede permitir que los usuarios que no sean operadores del bot utilicen las funciones del bot y los componentes de administración del servidor incluida si están habilitados. La versión 1.9.1 revierte la función que introdujo el error y la versión 1.9.2 reintroduce la función de forma segura. Se recomienda cambiar a la versión 1.8.3 si no es posible actualizar a la 1.9.1 o una versión superior."
    }
  ],
  "lastModified": "2026-06-17T08:57:54.567",
  "sourceIdentifier": "security-advisories@github.com"
}