Search for vulnerabilities
Vulnerability details: VCID-xfrf-skay-4qf8
Vulnerability ID VCID-xfrf-skay-4qf8
Aliases CVE-2024-42369
GHSA-vhr5-g3pm-49fm
Summary matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-674 Uncontrolled Recursion
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00024 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00169 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
epss 0.00579 https://api.first.org/data/v1/epss?cve=CVE-2024-42369
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-vhr5-g3pm-49fm
cvssv3.1 4.1 https://github.com/matrix-org/matrix-js-sdk
generic_textual HIGH https://github.com/matrix-org/matrix-js-sdk
cvssv3.1 4.1 https://github.com/matrix-org/matrix-js-sdk/commit/a0efed8b881b3db6c9f2c71d6a6e74c2828978c6
generic_textual MODERATE https://github.com/matrix-org/matrix-js-sdk/commit/a0efed8b881b3db6c9f2c71d6a6e74c2828978c6
cvssv3.1 4.1 https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-vhr5-g3pm-49fm
generic_textual MODERATE https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-vhr5-g3pm-49fm
cvssv3 5.3 https://nvd.nist.gov/vuln/detail/CVE-2024-42369
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2024-42369
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-42369
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42369
https://github.com/matrix-org/matrix-js-sdk
https://github.com/matrix-org/matrix-js-sdk/commit/a0efed8b881b3db6c9f2c71d6a6e74c2828978c6
https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-vhr5-g3pm-49fm
cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:*:*:*
CVE-2024-42369 https://nvd.nist.gov/vuln/detail/CVE-2024-42369
GHSA-vhr5-g3pm-49fm https://github.com/advisories/GHSA-vhr5-g3pm-49fm
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L Found at https://github.com/matrix-org/matrix-js-sdk
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L Found at https://github.com/matrix-org/matrix-js-sdk/commit/a0efed8b881b3db6c9f2c71d6a6e74c2828978c6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L Found at https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-vhr5-g3pm-49fm
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2024-42369
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2024-42369
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.01512
EPSS Score 0.00014
Published At April 20, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2024-09-17T19:10:49.050744+00:00 NVD Importer Import https://nvd.nist.gov/vuln/detail/CVE-2024-42369 34.0.1