Missing Authorization in Matrix Javascript SDK - CVE-2024-47080
Published: October 16, 2024
Vulnerability identifier: #VU98728
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-47080
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the way the MatrixClient.sendSharedHistoryKeys method shares historical message keys with newly invited users. A remote attacker can inject their own devices to receive sensitive historical keys and access past messages in the room without proper security checks.
Affected software
Matrix Javascript SDK
How to mitigate CVE-2024-47080
Install updates from vendor's website.
Matrix Javascript SDK - update to 34.8.0