CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
36.0%
Severity: High
Date : 2021-09-14
CVE-ID : CVE-2021-40823
Package : element-web
Type : information disclosure
Remote : Yes
Link : https://security.archlinux.org/AVG-2377
The package element-web before version 1.8.4-1 is vulnerable to
information disclosure.
Upgrade to 1.8.4-1.
The problem has been fixed upstream in version 1.8.4.
None.
A security has been found in matrix-js-sdk before version 12.4.1, as
used by Element Web/Desktop before version 1.8.4. In certain
circumstances it may be possible to trick vulnerable clients into
disclosing encryption keys for messages previously sent by that client
to user accounts later compromised by an attacker.
Exploiting this vulnerability to read encrypted messages requires
gaining control over the recipientβs account. This requires either
compromising their credentials directly or compromising their
homeserver.
Thus, the greatest risk is to users who are in encrypted rooms
containing malicious servers. Admins of malicious servers could attempt
to impersonate their usersβ devices in order to spy on messages sent by
vulnerable clients in that room.
A remote attacker able to compromise a user account could disclose
encryption keys for messages previously sent by the Matrix client.
https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing/
https://github.com/matrix-org/matrix-js-sdk/commit/894c24880da0e1cc81818f51c0db80e3c9fb2be9
https://security.archlinux.org/CVE-2021-40823
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | element-web | <Β 1.8.4-1 | UNKNOWN |
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
36.0%