Lucene search

[email protected]NVD:CVE-2021-40824

HistorySep 13, 2021 - 7:15 p.m.

CVE-2021-40824

2021-09-1319:15:19

CWE-290

[email protected]

web.nvd.nist.gov

cve-2021-40824

logic error

element android

matrix-android-sdk2

room key sharing

encryption keys

matrix homeserver

crafted messages

end-to-end encryption

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

36.0%

JSON

A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 (aka Matrix SDK for Android) before 1.2.2 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the attacker to decrypt end-to-end encrypted messages sent by affected clients.

Affected configurations

Nvd

Node

matrixelementRange<1.2.2android

matrixmatrix-android-sdk2Range<1.2.2android

VendorProductVersionCPE
matrixelement*cpe:2.3:a:matrix:element:*:*:*:*:*:android:*:*
matrixmatrix-android-sdk2*cpe:2.3:a:matrix:matrix-android-sdk2:*:*:*:*:*:android:*:*