Information disclosure in Matrix Javascript SDK - CVE-2021-40823

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU56488

Information disclosure in Matrix Javascript SDK - CVE-2021-40823

Published: September 14, 2021 / Updated: December 16, 2024


Vulnerability identifier: #VU56488
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-40823
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to logic error in the room key sharing functionality in matrix-js-sdk. In certain circumstances it is possible to trick vulnerable clients into disclosing encryption keys for messages previously sent by that client to user accounts later compromised by an attacker.


Affected software

Matrix Javascript SDK
Arch Linux

How to mitigate CVE-2021-40823

Install updates from vendor's website.

Matrix Javascript SDK - update to 12.4.1

External References

Related Security Bulletins