CVE-2024-50336
CVSS V2 None
CVSS V3 None
Description
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1.
Overview
- CVE ID
- CVE-2024-50336
- Assigner
- GitHub_M
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-11-12T16:38:53.164Z
- Last Modified Date
- 2024-11-12T17:11:41.542Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w6xr | x_refsource_CONFIRM |
| https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5 | x_refsource_MISC |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-50336 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50336 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-11-13 13:55:10 | Added to TrackCVE |