CVE-2025-48937

MEDIUM4.9EPSS 0.27%

matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator

發布日:2025/6/10修改日:2025/6/12
也稱為:GHSA-x958-rvg6-956wRUSTSEC-2025-0041

描述

matrix-sdk-crypto versions 0.8.0 up to and including 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. Although the CVSS score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), we consider this a High severity security issue.

受影響套件(2)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM4.9CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

參考連結(8)