-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/matrix-org/dendrite | go | < 0.9.3 | 0.9.3 |
| github.com/matrix-org/gomatrixserverlib | go | < 0.0.0-20220815091947-723fd495dde8 | 0.0.0-20220815091947-723fd495dde8 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from incorrect JSON serialization in power level parsing. The commit diff shows the struct field was incorrectly tagged as 'event_default' instead of 'events_default'. Both NewPowerLevelContentFromEvent and NewPowerLevelContentFromAuthEvents would use this struct to unmarshal power level content, making them vulnerable. The Go vulnerability report (GO-2022-0952) explicitly lists these functions as affected symbols. The test case added in eventauth_test.go validates the fix for this parsing issue.
KEV Misses 88% of Exploited CVEs- Get the report