In breve
- CVE-2021-32622 è una vulnerabilità ALTO (CVSS 7.8) che riguarda matrix-react-sdk (matrix-react-sdk project), matrix-react-sdk.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.37%, superiore al 31.3% delle vulnerabilità.
- Correzione: aggiornare a 3.21.0 o successiva.
Description
Impact
When uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file, but only after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users.
Patches
This has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5981, which is included in 3.21.0.
Workarounds
There are no known workarounds.
NVD description
Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free