CVE-2023-38700

    Dashboard / Vulnerabilities / CVE-2023-38700

    CVE-2023-38700

    Published: 4 Aug 2023Last Modified: 12 Aug 2026

    Summary: matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms

    Details: matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target. Version 1.0.1n fixes this issue. As a workaround, set the `matrixHandler.eventCacheSize` config value to `0`. This workaround may impact performance.

    References: https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38700.json, https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-c7hh-3v6c-fj4q, https://nvd.nist.gov/vuln/detail/CVE-2023-38700, https://github.com/matrix-org/matrix-appservice-irc/commit/8bbd2b69a16cbcbeffdd9b5c973fd89d61498d75

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c557cbe011a81a930e0c2cba599ebca021a7cab8

    Affected versions

    1.0.0
    1.0.0-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-38700 | CVE-DB