CVE-2024-50336: fallo de gravedad media en matrix-org matrix-js-sdk
matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.8%
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Productos afectados
matrix-org · matrix-js-sdkCVEs relacionadas — matrix-org matrix-js-sdk
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-39236MEDIUMMatrix Javascript SDK improper beacon events can cause availability issuesEPSS 1.4%CVE-2022-39249HIGHMatrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessionsEPSS 1.3%CVE-2022-39250HIGHMatrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verificationEPSS 1.2%CVE-2023-28427HIGHPrototype pollution in matrix-js-sdkEPSS 1.2%CVE-2022-39251HIGHMatrix Javascript SDK vulnerable to Olm/Megolm protocol confusionEPSS 1.2%CVE-2022-36059HIGHPrototype pollution in matrix-js-sdkEPSS 0.9%