PT-2022-26135 · Matrix · Element Ios

Kasak · Published 2022-11-11 · Updated 2022-11-16 · CVE-2022-41904

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Element iOS versions prior to 1.9.7

Description The issue affects the Element iOS client, which is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly, allowing a malicious homeserver to inject messages into the room without the user being alerted. This could happen even if the user has previously verified all group members.

Recommendations For versions prior to 1.9.7, update to version 1.9.7 to resolve the issue. As a temporary workaround, consider restricting access to unverified group members to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-357

Related Identifiers

CVE-2022-41904

GHSA-FM8M-99J7-323G

Affected Products

Element Ios

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41904.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-41904 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41904 · Security Note
• https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323g · Note
• https://github.com/vector-im/element-ios/releases/tag/v1.9.7 · Note
• https://t.me/cvenotify/37555 · Telegram Post