CVE-2021-32622
Medium
Description
Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.
SeverityMedium
CVSS4.2
Exploit probability—
ProductMatrix-react-sdk
PublishedMay 17, 2021
First seenMay 17, 2021
Weakness typeCWE-74Injection
How to fix
Update
- matrix-react-sdk_project matrix-react-sdk3.21.0 or later
- matrix-react-sdk3.21.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| matrix-react-sdk_project matrix-react-sdk | v < 3.21.0 | 3.21.0 |
| matrix-react-sdknpm | v < 3.21.0 | 3.21.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.