CVE-2023-30609
Medium
Description
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.
SeverityMedium
CVSS5.4
Exploit probability—
ProductMatrix-react-sdk
PublishedApr 25, 2023
First seenApr 25, 2023
Weakness typeCWE-74Injection
How to fix
Update
- matrix-react-sdk_project matrix-react-sdk3.71.0 or later
- matrix-react-sdk3.71.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| matrix-react-sdk_project matrix-react-sdk | v < 3.71.0 | 3.71.0 |
| matrix-react-sdknpm | v < 3.71.0 | 3.71.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.