{"action":"Upgrade github.com/matrix-org/dendrite to 0.9.3 or later.","affected":[{"fixed":"0.9.3","introduced":"0"}],"component":"github.com/matrix-org/dendrite","cve_ids":["CVE-2022-36009"],"ecosystem":"Go","epss":0.00859,"exploited":false,"fixed_versions":["0.9.3"],"ghsa_id":"GHSA-grvv-h2f9-7v9c","id":"tcs_01M5KFBCEQG98YJ4EKEDHXHNB9","modified_at":"2023-11-08T04:09:57.073105Z","published_at":"2022-08-30T19:54:34Z","references":["https://osv.dev/vulnerability/GHSA-grvv-h2f9-7v9c","https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-grvv-h2f9-7v9c","https://nvd.nist.gov/vuln/detail/CVE-2022-36009","https://github.com/matrix-org/gomatrixserverlib/commit/723fd495dde835d078b9f2074b6b62c06dea4575","https://github.com/matrix-org/gomatrixserverlib","https://matrix.org/docs/guides/moderation/#power-levels","https://pkg.go.dev/vuln/GO-2022-0952"],"severity":{"label":"medium","score":5},"sources":[{"source":"osv","source_id":"GHSA-grvv-h2f9-7v9c","url":"https://osv.dev/vulnerability/GHSA-grvv-h2f9-7v9c"}],"summary":"gomatrixserverlib and Dendrite vulnerable to incorrect parsing of the event default power level in event auth"}