Home > Vulnerability Database > CVE-2024-47824

Mend.io Vulnerability Database

CVE-2024-47824

Good to know:

Date: October 15, 2024

matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0 and before 3.102.0, matrix-react-sdk allows a malicious homeserver to potentially steal message keys for a room when a user invites another user to that room, via injection of a malicious device controlled by the homeserver. This is possible because matrix-react-sdk before 3.102.0 shared historical message keys on invite. Version 3.102.0 fixes this issue by disabling sharing message keys on invite by removing calls to the vulnerable functionality. No known workarounds are available.

Language: TYPE_SCRIPT

Severity Score

0.0

Related Resources (6)

Url: https://github.com/matrix-org/matrix-react-sdk/pull/12618

Url: https://github.com/matrix-org/matrix-react-sdk

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-47824

Url: https://github.com/matrix-org/matrix-react-sdk/commit/6fc9d7641c51ca3db8225cf58b9d6e6fdd2d6556

Url: https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-qcvh-p9jq-wp8v

Url: https://www.mend.io/vulnerability-database/CVE-2024-47824

Weakness Type (CWE)

Information Leak / Disclosure

CWE-200

Top Fix

Upgrade Version

Upgrade to version matrix-react-sdk - 3.102.0

Learn More

CVSS v3.1

Base Score:	0.0
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	NONE