CVE-2024-47779: falha de alta gravidade em element-hq element-web
Element Web vulnerable to potential exposure of access token via authenticated media
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7epss 0.4%
Element is a Matrix web client built using the Matrix React SDK. Element Web versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Note that despite superficial similarity to CVE-2024-47771, this is an entirely separate vulnerability, caused by a separate piece of code included only in Element Web. Element Web and Element Desktop share most but not all, of their code and this vulnerability exists in the part of the code base which is not shared between the projects. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
element-hq · element-webCVEs relacionadas — element-hq element-web
No mesmo produto, das mais perigosas para as menos.
CVE-2026-55850MEDIUMElement Web: A malicious homeserver can inject HTML in Element Web using its homepageEPSS 0.5%CVE-2024-51750MEDIUMElement allows a malicious homeserver can modify events leading to unrenderable events or roomsEPSS 0.5%CVE-2025-59161LOWIn Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is leftEPSS 0.4%CVE-2024-51749LOWElement's thumbnails can be abused to misrepresent the content of an attachmentEPSS 0.4%CVE-2025-32026LOWElement Web could load a malicious instance of Element Call leaking media encryption keysEPSS 0.2%CVE-2026-119407HIGHElement Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL ParametersEPSS 0.1%