deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-32168
Published: 2022-09-28
Description: Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/notepad-plus-plus/notepad-plus-plus/commit/85d7215d9b3e0d5a8433fc31aec4f[PII_REDACTED]e; https://www.mend.io/vulnerability-database/CVE-2022-32168; https://github.com/notepad-plus-plus/notepad-plus-plus/commit/85d7215d9b3e0d5a8433fc31aec4f[PII_REDACTED]e
CVE: CVE-2022-3348
Published: 2022-09-28
Description: Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/tooljet/tooljet/commit/37bf6de75f161e03c2a[PII_REDACTED]8b913863a46; https://huntr.dev/bounties/aae4aeb8-2612-4254-85e5-90675b082eac; https://github.com/tooljet/tooljet/commit/37bf6de75f161e03c2a[PII_REDACTED]8b913863a46
CVE: CVE-2022-32166
Published: 2022-09-28
Description: In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-125
References: https://github.com/cloudbase/ovs/commit/2ed6505555cdcb46f9b1f0329d1491b75290fc73; https://lists.debian.org/debian-lts-announce/2022/10/msg00036.html; https://www.mend.io/vulnerability-database/CVE-2022-32166
CVE: CVE-2022-32169
Published: 2022-09-28
Description: The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-732
References: https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/issue.ts#L108-L187; https://www.mend.io/vulnerability-database/CVE-2022-32169; https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/issue.ts#L108-L187
CVE: CVE-2022-32170
Published: 2022-09-28
Description: The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197; https://www.mend.io/vulnerability-database/CVE-2022-32170; https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197
CVE: CVE-2022-30935
Published: 2022-09-28
Description: An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any user through the use of a bad randomness function. This allows the attacker to get valid sessions for arbitrary users, and optionally reset their password. Tested and confirmed in a default installation of version 7.2.3. Earlier versions are affected, possibly earlier major versions as well.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-330, CWE-330
References: https://b2evolution.net/downloads/7-2-5-stable; https://github.com/b2evolution/b2evolution/blob/master/inc/_core/_misc.funcs.php#L5955; https://github.com/b2evolution/b2evolution/issues/114
CVE: CVE-2022-2760
Published: 2022-09-28
Description: In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://advisories.octopus.com/post/2022/sa2022-14/; https://advisories.octopus.com/post/2022/sa2022-14/
CVE: CVE-2022-3349
Published: 2022-09-28
Description: A vulnerability was found in Sony PS4 and PS5. It has been classified as critical. This affects the function UVFAT_readupcasetable of the component exFAT Handler. The manipulation of the argument dataLength leads to heap-based buffer overflow. It is possible to launch the attack on the physical device. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-209679.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://hackerone.com/reports/1340942; https://vuldb.com/?id.209679; https://hackerone.com/reports/1340942
CVE: CVE-2022-40486
Published: 2022-09-28
Description: TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/gscamelo/TP-Link-Archer-AX10-V1/blob/main/README.md; https://www.tp-link.com/br/home-networking/wifi-router/archer-ax10/; https://www.tp-link.com/br/support/download/archer-ax10/v1/
CVE: CVE-2021-43980
Published: 2022-09-28
Description: The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.
CVSS Score: 3.7 (LOW)
CWE: CWE-362, CWE-362
References: http://www.openwall.com/lists/oss-security/2022/09/28/1; https://lists.apache.org/thread/3jjqbsp6j88b198x5rmg99b1qr8ht3g3; https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html
CVE: CVE-2022-22522
Published: 2022-09-28
Description: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://cert.vde.com/en/advisories/VDE-2022-029/; https://cert.vde.com/en/advisories/VDE-2022-029/
CVE: CVE-2022-22523
Published: 2022-09-28
Description: An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access is disabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://cert.vde.com/en/advisories/VDE-2022-029/; https://cert.vde.com/en/advisories/VDE-2022-029/
CVE: CVE-2022-22524
Published: 2022-09-28
Description: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modify users and stop services .
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://cert.vde.com/en/advisories/VDE-2022-029/; https://cert.vde.com/en/advisories/VDE-2022-029/
CVE: CVE-2022-22525
Published: 2022-09-28
Description: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2022-029/; https://cert.vde.com/en/advisories/VDE-2022-029/
CVE: CVE-2022-22526
Published: 2022-09-28
Description: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a missing authentication allows for full access via API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://cert.vde.com/en/advisories/VDE-2022-029/; https://cert.vde.com/en/advisories/VDE-2022-029/
CVE: CVE-2022-28811
Published: 2022-09-28
Description: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input validation on an API-submitted parameter to execute arbitrary OS commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://cert.vde.com/en/advisories/VDE-2022-029/; https://cert.vde.com/en/advisories/VDE-2022-029/
CVE: CVE-2022-28812
Published: 2022-09-28
Description: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain SuperUser access to the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://cert.vde.com/en/advisories/VDE-2022-029/; https://cert.vde.com/en/advisories/VDE-2022-029/
CVE: CVE-2022-28813
Published: 2022-09-28
Description: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a volatile temporary database with the current states of the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://cert.vde.com/en/advisories/VDE-2022-029/; https://cert.vde.com/en/advisories/VDE-2022-029/
CVE: CVE-2022-28814
Published: 2022-09-28
Description: Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-23, CWE-22
References: https://cert.vde.com/en/advisories/VDE-2022-029/; https://cert.vde.com/en/advisories/VDE-2022-029/
CVE: CVE-2022-28815
Published: 2022-09-28
Description: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulnerability allowing an attacker to query other tables of the Sentilo service.
CVSS Score: 2.7 (LOW)
CWE: CWE-89
References: https://cert.vde.com/en/advisories/VDE-2022-029/; https://cert.vde.com/en/advisories/VDE-2022-029/
CVE: CVE-2022-28816
Published: 2022-09-28
Description: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentilo service.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cert.vde.com/en/advisories/VDE-2022-029/; https://cert.vde.com/en/advisories/VDE-2022-029/
CVE: CVE-2022-39261
Published: 2022-09-28
Description: Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b; https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33; https://lists.debian.org/debian-lts-announce/2022/10/msg00016.html
CVE: CVE-2022-40082
Published: 2022-09-28
Description: Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/cloudwego/hertz/issues/228; https://github.com/cloudwego/hertz/pull/229; https://github.com/cloudwego/hertz/issues/228
CVE: CVE-2022-40083
Published: 2022-09-28
Description: Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-601, CWE-601
References: https://github.com/labstack/echo/issues/2259; https://github.com/labstack/echo/issues/2259
CVE: CVE-2022-40912
Published: 2022-09-28
Description: ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting (XSS). Input passed to the GET parameter 'action' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in context of an affected site.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php
CVE: CVE-2022-40942
Published: 2022-09-28
Description: Tenda TX3 US_TX3V1.0br_V16.03.13.11 is vulnerable to stack overflow via compare_parentcontrol_time.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Rumble0x0/vulnerability/blob/main/tenda/TX3/stack%20overflow%20via%20compare_parentcontrol_time.pdf; https://github.com/Rumble0x0/vulnerability/blob/main/tenda/TX3/stack%20overflow%20via%20compare_parentcontrol_time.pdf
CVE: CVE-2022-22387
Published: 2022-09-28
Description: IBM Application Gateway is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 221965.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221965; https://www.ibm.com/support/pages/node/6824247; https://exchange.xforce.ibmcloud.com/vulnerabilities/221965
CVE: CVE-2022-35282
Published: 2022-09-28
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230809; https://www.ibm.com/support/pages/node/6824179; https://exchange.xforce.ibmcloud.com/vulnerabilities/230809
CVE: CVE-2022-35722
Published: 2022-09-28
Description: IBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231381.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/231381; https://www.ibm.com/support/pages/node/6824117; https://exchange.xforce.ibmcloud.com/vulnerabilities/231381
CVE: CVE-2022-36448
Published: 2022-09-28
Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the PnpSmm driver.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20, CWE-20
References: https://binarly.io/advisories/BRLY-2022-023/index.html; https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/SA-2022032
CVE: CVE-2022-36771
Published: 2022-09-28
Description: IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access to. IBM X-Force ID: 232791.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/232791; https://www.ibm.com/support/pages/node/6824197; https://exchange.xforce.ibmcloud.com/vulnerabilities/232791
CVE: CVE-2022-3354
Published: 2022-09-28
Description: A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic. This vulnerability affects unknown code in the library lib/core/ogs-tlv-msg.c of the component UDP Packet Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-209686 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-404
References: https://github.com/open5gs/open5gs/issues/1767; https://vuldb.com/?id.209686; https://github.com/open5gs/open5gs/issues/1767
CVE: CVE-2021-41434
Published: 2022-09-28
Description: A stored Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the Expense Management System application that allows for arbitrary execution of JavaScript commands through index.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://egavilanmedia.com/Expense-Management-System/; https://github.com/martinkubecka/CVE-References/blob/main/CVE-2021-41434.md; https://egavilanmedia.com/Expense-Management-System/
CVE: CVE-2022-38934
Published: 2022-09-28
Description: readelf in ToaruOS 2.0.1 has some arbitrary address read vulnerabilities when parsing a crafted ELF file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://github.com/klange/toaruos/issues/244; https://github.com/klange/toaruos/issues/244
CVE: CVE-2022-39236
Published: 2022-09-28
Description: Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This is patched in matrix-js-sdk v19.7.0. Redacting applicable events, waiting for the sync processor to store data, and restarting the client are possible workarounds. Alternatively, redacting the applicable events and clearing all storage will fix the further perceived issues. Downgrading to an unaffected version, noting that such a version may be subject to other vulnerabilities, will additionally resolve the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76; https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0; https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-hvv8-5v86-r45x
CVE: CVE-2022-40929
Published: 2022-09-28
Description: XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/xuxueli/xxl-job/issues/2979; https://github.com/xuxueli/xxl-job/issues/2979
CVE: CVE-2022-3193
Published: 2022-09-28
Description: An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine. A parameter "error_description" fails to sanitize the entry, allowing the vulnerability to trigger on the Windows Service Accounts home pages.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=2126353; https://bugzilla.redhat.com/show_bug.cgi?id=2126353
CVE: CVE-2022-1270
Published: 2022-09-28
Description: In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://lists.debian.org/debian-lts-announce/2022/11/msg00028.html; https://security.gentoo.org/glsa/202209-19; https://sourceforge.net/p/graphicsmagick/bugs/664/
CVE: CVE-2022-23716
Published: 2022-09-28
Description: A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://discuss.elastic.co/t/elastic-cloud-enterprise-3-1-1-security-update/315317; https://www.elastic.co/community/security/; https://discuss.elastic.co/t/elastic-cloud-enterprise-3-1-1-security-update/315317
CVE: CVE-2022-36781
Published: 2022-09-28
Description: ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting access code combinations. ConnectWise has addressed this issue in later versions by implementing rate-limiting controls as a preventive measure against brute force attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-39246
Published: 2022-09-28
Description: matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the key forwarding strategy implemented in the matrix-android-sdk2 that is too permissive. Starting with version 1.5.1, the default policy for accepting key forwards has been made more strict in the matrix-android-sdk2. The matrix-android-sdk2 will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages). As a workaroubnd, current users of the SDK can disable key forwarding in their forks using `CryptoService#enableKeyGossiping(enable: Boolean)`.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-322
References: https://github.com/matrix-org/matrix-android-sdk2/commit/77df720a238d17308deab83ecaa37f7a4740a17e; https://github.com/matrix-org/matrix-android-sdk2/releases/tag/v1.5.1; https://github.com/matrix-org/matrix-android-sdk2/security/advisories/GHSA-2pvj-p485-cp3m
CVE: CVE-2022-39248
Published: 2022-09-28
Description: matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. matrix-android-sdk2 would then additionally sign such a key backup with its device key, spilling trust over to other devices trusting the matrix-android-sdk2 device. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. matrix-android-sdk2 version 1.5.1 has been modified to only accept Olm-encrypted to-device messages and to stop signing backups on a successful decryption. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.
CVSS Score: 8.6 (HIGH)
CWE: CWE-287, CWE-322
References: https://github.com/matrix-org/matrix-android-sdk2/commit/77df720a238d17308deab83ecaa37f7a4740a17e; https://github.com/matrix-org/matrix-android-sdk2/releases/tag/v1.5.1; https://github.com/matrix-org/matrix-android-sdk2/security/advisories/GHSA-fpgf-pjjv-2qgm