Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-28103

CVE-2023-28103:
Prototype pollution in matrix-react-sdk

8.2

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-28103
GHSA ID
GHSA-6g43-88cp-w5gv
EPSS Score
0.45853%
CWE
CWE-1321
Published
3/29/2023
Updated
3/29/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
matrix-react-sdknpm< 3.69.03.69.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The provided vulnerability information describes prototype pollution risks in matrix-react-sdk but does not include concrete code examples, commit diffs, or specific function names. While the general mechanism (unsafe object property assignment/merging with attacker-controlled keys like proto) is clear, the advisory and references lack sufficient technical details to confidently identify specific functions. The CVE and GHSA descriptions reference a codebase audit but do not disclose which functions were patched in 3.69.0. Without access to the actual code changes or patch details, it is not possible to pinpoint vulnerable functions with high confidence.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t In **rt*in *on*i*ur*tions, **t* s*nt *y r*mot* s*rv*rs *ont*inin* sp**i*l strin*s in k*y lo**tions *oul* **us* mo*i*i**tions o* t** `O*j**t.prototyp*`, *isruptin* m*trix-r***t-s*k *un*tion*lity, **usin* **ni*l o* s*rvi** *n* pot*nti*lly **

Reasoning

T** provi*** vuln*r**ility in*orm*tion **s*ri**s prototyp* pollution risks in m*trix-r***t-s*k *ut *o*s not in*lu** *on*r*t* *o** *x*mpl*s, *ommit *i**s, or sp**i*i* *un*tion n*m*s. W*il* t** **n*r*l m****nism (uns*** o*j**t prop*rty *ssi*nm*nt/m*r*i