PT-2021-19814 · Unknown · Matrix-React-Sdk

Mr-Zheev · Published 2021-05-17 · Updated 2022-02-10 · CVE-2021-32622

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Matrix-React-SDK versions prior to 3.21.0

Description The issue arises when uploading a file, as the local file preview can lead to the execution of scripts embedded in the uploaded file. This occurs after several user interactions to open the preview in a separate tab. The impact is limited to the local user during the upload process and cannot be exploited remotely or by other users.

Recommendations For versions prior to 3.21.0, update to version 3.21.0 to resolve the issue.

Fix

Unrestricted File Upload

Special Elements Injection

Weakness Enumeration

CWE-434

CWE-74

Related Identifiers

CVE-2021-32622

GHSA-8796-GC9J-63RV

GHSA-CG57-P69R-3M7P

Affected Products

Matrix-React-Sdk

References · 8

• https://github.com/matrix-org/matrix-react-sdk/pull/5981 · Patch
• https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-8796-gc9j-63rv · Patch
• https://osv.dev/vulnerability/GHSA-8796-gc9j-63rv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32622 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32622 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cg57-p69r-3m7p · Vendor Advisory
• https://github.com/matrix-org/matrix-react-sdk · Note
• https://npmjs.com/package/matrix-react-sdk · Note