There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent
    by remote servers containing special strings in key locations could cause modifications of the
    `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially
    affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There
    are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr
    which refers to a similar issue. (CVE-2023-28103)

  - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0
    events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from
    functioning properly, potentially impacting the consumer's ability to process data safely. Note that the
    matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to
    the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The
    issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known
    workarounds for this vulnerability. (CVE-2023-28427)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent
    by remote servers containing special strings in key locations could cause modifications of the
    `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially
    affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There
    are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr
    which refers to a similar issue. (CVE-2023-28103)

リモートホストにインストールされている FreeBSD のバージョンは、テスト済みバージョンより前です。したがって、5b0ae405-cdc7-11ed-bb39-901b0e9408dc のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - matrix-react-sdk は、React Javascript 用の Matrix チャットプロトコル SDK です。特定の構成では、特別な文字列を主要な場所に含むリモートサーバーから送信されたデータにより、「Object.prototype」が変更されます。これにより、matrix-react-sdk 機能が中断されたり、サービス拒否が引き起こされたり、プログラムロジックに影響を与えたりする可能性があります。これは matrix-react-sdk 3.69.0 で修正されており、ユーザーはアップグレードすることが推奨されます。この脆弱性に対する既知の回避策はありません。このアドバイザリは、類似の問題を参照する GHSA-2x9c-qwgf-94xr とは異なります。(CVE-2023-28103)

  - matrix-js-sdk は、JavaScript 用の Matrix メッセージングプロトコル Client-Server SDK です。24.0.0 以前のバージョンでは、主な場所に特別な文字列を持つイベントが送信されると、matrix-js-sdk が適切に機能することが一時的に中断させられたり、妨げられたりする可能性があります。これにより、データを安全に処理するコンシューマーの機能に影響を与える可能性があります。注意:matrix-js-sdk は正常に動作しているように見えても、コンシューマーに提示されるランタイムデータを排除または破損させている可能性があります。この脆弱性は、類似の問題をカバーする GHSA-rfv9-x7hh-xc32 とは異なります。この問題は、matrix-js-sdk 24.0.0 でパッチされており、ユーザーはアップグレードすることが推奨されます。この脆弱性に対する既知の回避策はありません。(CVE-2023-28427)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 5b0ae405-cdc7-11ed-bb39-901b0e9408dc advisory.

  - matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent     by remote servers containing special strings in key locations could cause modifications of the     `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially     affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There     are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr     which refers to a similar issue. (CVE-2023-28103)

  - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0     events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from     functioning properly, potentially impacting the consumer's ability to process data safely. Note that the     matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to     the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The     issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2023-28427)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
406929	Alpine: riot-web: security update to 1.11.26-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
406929	Alpine: riot-web: security update to 1.11.26-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
411419	SCA: security update for matrix-react-sdk (GHSA-6g43-88cp-w5gv)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	high
404214	Alpine: element-web: security update to 1.11.26-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
411419	SCA: security update for matrix-react-sdk (GHSA-6g43-88cp-w5gv)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	high
404214	Alpine: element-web: security update to 1.11.26-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
173613	FreeBSD : Matrix クライアント -- matrix-js-sdk のプロトタイプ汚染 (5b0ae405-cdc7-11ed-bb39-901b0e9408dc)	Nessus	FreeBSD Local Security Checks	2023/3/28	2023/10/24	high
173613	FreeBSD : Matrix clients -- Prototype pollution in matrix-js-sdk (5b0ae405-cdc7-11ed-bb39-901b0e9408dc)	Nessus	FreeBSD Local Security Checks	2023/3/28	2023/10/24	high

检测

插件搜索

high

high

high

high

high

high

high

high