En resumen
- CVE-2021-21320 es una vulnerabilidad MEDIO (CVSS 4.3) que afecta a matrix-react-sdk (matrix-react-sdk project), matrix-react-sdk.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.92%, mayor que el 60.3% de las vulnerabilidades.
- Solución: actualizar a 3.15.0 o posterior.
Description
Impact
The user content sandbox can be abused to trick users into opening unexpected documents after several user interactions. The content can be opened with a blob origin from the Matrix client, so it is possible for a malicious document to access user messages and secrets.
Patches
This has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5657, which is included in 3.15.0.
Workarounds
There are no known workarounds.
NVD description
matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a `blob` origin that cannot access Matrix user data, so messages and secrets are not at risk. This has been fixed in version 3.15.0.
Más vulnerabilidades de matrix-react-sdk
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free