Lucene search

GitHub_MCVE-2021-32622

HistoryMay 17, 2021 - 8:15 p.m.

CVE-2021-32622

2021-05-1720:15:07

CWE-74

CWE-434

GitHub_M

web.nvd.nist.gov

matrix-react-sdk

cve-2021-32622

file upload

security vulnerability

script execution

nvd

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

49.6%

JSON

Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.

Affected configurations

Nvd

Vulners

Node

matrix-react-sdk_projectmatrix-react-sdkRange<3.21.0node.js

VendorProductVersionCPE
matrix-react-sdk_projectmatrix-react-sdk*cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
matrix-react-sdk_project	matrix-react-sdk	*	cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk::::::node.js::*

CNA Affected

[
  {
    "product": "matrix-react-sdk",
    "vendor": "matrix-org",
    "versions": [
      {
        "status": "affected",
        "version": "< 3.21.0"
      }
    ]
  }
]

References

github.com/matrix-org/matrix-react-sdk/pull/5981

github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-8796-gc9j-63rv

Social References

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

49.6%

JSON

Related for CVE-2021-32622