ByteOS Network

NVD Vulnerability Details :

CVE-2024-42347

Analyzed

Source-security-advisories@github.com

Published At-06 Aug, 2024 | 18:15

Updated At-12 Aug, 2024 | 18:52

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the server. This was patched in matrix-react-sdk 3.105.0. Deployments that trust their homeservers, as well as closed federations of trusted servers, are not affected. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Secondary	3.1	7.7	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CPE Matches

The Matrix.org Foundation

>>matrix-react-sdk>>Versions before 3.105.1(exclusive)

cpe:2.3:a:matrix:matrix-react-sdk:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-359	Secondary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.105.1	security-advisories@github.com	Release Notes
https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-f83w-wqhc-cfp4	security-advisories@github.com	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History