Search for vulnerabilities
Vulnerability details: VCID-6x8d-d7vv-gfd1
Vulnerability ID VCID-6x8d-d7vv-gfd1
Aliases CVE-2022-39249
GHSA-6263-x97c-c4gg
Summary Thunderbird users who use the Matrix chat protocol were vulnerable to an impersonation attack. A malicious server administrator could fake encrypted messages to look as if they were sent from another user on that server.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-287 Improper Authentication
CWE-322 Key Exchange without Entity Authentication
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-39249.json
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2022-39249
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-6263-x97c-c4gg
cvssv3.1 7.5 https://github.com/matrix-org/matrix-js-sdk
generic_textual HIGH https://github.com/matrix-org/matrix-js-sdk
cvssv3.1 7.5 https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76
generic_textual HIGH https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76
ssvc Track https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76
cvssv3.1 7.5 https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0
generic_textual HIGH https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0
ssvc Track https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0
cvssv3.1 7.5 https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6263-x97c-c4gg
cvssv3.1_qr HIGH https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6263-x97c-c4gg
generic_textual HIGH https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6263-x97c-c4gg
ssvc Track https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6263-x97c-c4gg
cvssv3.1 7.5 https://github.com/matrix-org/matrix-spec-proposals/pull/3061
generic_textual HIGH https://github.com/matrix-org/matrix-spec-proposals/pull/3061
ssvc Track https://github.com/matrix-org/matrix-spec-proposals/pull/3061
cvssv3.1 7.5 https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients
generic_textual HIGH https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients
ssvc Track https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-39249
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-39249
cvssv3.1 7.5 https://security.gentoo.org/glsa/202210-35
generic_textual HIGH https://security.gentoo.org/glsa/202210-35
ssvc Track https://security.gentoo.org/glsa/202210-35
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2022-43
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-39249.json
https://api.first.org/data/v1/epss?cve=CVE-2022-39249
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39249
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/matrix-org/matrix-js-sdk
https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76
https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0
https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6263-x97c-c4gg
https://github.com/matrix-org/matrix-spec-proposals/pull/3061
https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients
https://nvd.nist.gov/vuln/detail/CVE-2022-39249
https://security.gentoo.org/glsa/202210-35
1021136 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1021136
2135393 https://bugzilla.redhat.com/show_bug.cgi?id=2135393
cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:*
GHSA-6263-x97c-c4gg https://github.com/advisories/GHSA-6263-x97c-c4gg
mfsa2022-43 https://www.mozilla.org/en-US/security/advisories/mfsa2022-43
RHSA-2022:7178 https://access.redhat.com/errata/RHSA-2022:7178
RHSA-2022:7181 https://access.redhat.com/errata/RHSA-2022:7181
RHSA-2022:7182 https://access.redhat.com/errata/RHSA-2022:7182
RHSA-2022:7183 https://access.redhat.com/errata/RHSA-2022:7183
RHSA-2022:7184 https://access.redhat.com/errata/RHSA-2022:7184
RHSA-2022:7190 https://access.redhat.com/errata/RHSA-2022:7190
USN-5724-1 https://usn.ubuntu.com/5724-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-39249.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/matrix-org/matrix-js-sdk
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:51:04Z/ Found at https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:51:04Z/ Found at https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6263-x97c-c4gg
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:51:04Z/ Found at https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6263-x97c-c4gg
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/matrix-org/matrix-spec-proposals/pull/3061
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:51:04Z/ Found at https://github.com/matrix-org/matrix-spec-proposals/pull/3061
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:51:04Z/ Found at https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-39249
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://security.gentoo.org/glsa/202210-35
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:51:04Z/ Found at https://security.gentoo.org/glsa/202210-35
Exploit Prediction Scoring System (EPSS)
Percentile 0.34184
EPSS Score 0.00136
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:10:05.221870+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2022/mfsa2022-43.yml 37.0.0