CVE-2024-47824 — Sensitive Information Exposure in Project Matrix-react-sdk

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
8.7HIGHNVD
EPSS
0.5%
top 32.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Matrix-react-sdk Project Matrix-react-sdkMatrix-org Matrix-react-sdk
Timeline
PublishedOct 15

Description

matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0 and before 3.102.0, matrix-react-sdk allows a malicious homeserver to potentially steal message keys for a room when a user invites another user to that room, via injection of a malicious device controlled by the homeserver. This is possible because matrix-react-sdk before 3.102.0 shared historical message keys on invite. Version 3.102.0 fixes this issue by…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5matrix-org/matrix-react-sdk>= 3.18.0, < 3.102.0

🔴Vulnerability Details

3
OSV
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room↗2024-10-15
▶
GHSA
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room↗2024-10-15
▶
CVEList
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room↗2024-10-15
▶
CVE-2024-47824 — Sensitive Information Exposure | cvebase