CVE-2024-42347
High
Description
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the server. This was patched in matrix-react-sdk 3.105.0. Deployments that trust their homeservers, as well as closed federations of trusted servers, are not affected. Users are advised to upgrade. There are no known workarounds for this vulnerability.
SeverityHigh
CVSS7.7
Exploit probability—
ProductMatrix-react-sdk
PublishedAug 6, 2024
First seenAug 6, 2024
Weakness typeCWE-359CWE-359
How to fix
Update
- matrix matrix-react-sdk3.105.1 or later
- matrix-react-sdk3.105.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| matrix matrix-react-sdk | v < 3.105.1 | 3.105.1 |
| matrix-react-sdknpm | v < 3.105.1 | 3.105.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.