Em resumo
- CVE-2021-32622 é uma vulnerabilidade ALTO (CVSS 7.8) que afeta matrix-react-sdk (matrix-react-sdk project), matrix-react-sdk.
- Chance de exploração nos próximos 30 dias (EPSS): 0.37%, maior que 31.3% das vulnerabilidades.
- Correção: atualize para 3.21.0 ou posterior.
Description
Impact
When uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file, but only after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users.
Patches
This has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5981, which is included in 3.21.0.
Workarounds
There are no known workarounds.
NVD description
Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.
Mais vulnerabilidades de matrix-react-sdk
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free