CVE-2024-51749

CVSS V2 None CVSS V3 None

Description

Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file download once clicked. Fixed in element-web 1.11.85.

Overview

CVE ID
CVE-2024-51749

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-11-12T16:34:21.603Z

Last Modified Date
2024-11-12T17:14:30.943Z

Weakness Enumerations

CWE	URL
CWE-451	http://cwe.mitre.org/data/definitions/451.html

References

Reference URL	Reference Tags
https://github.com/element-hq/element-web/security/advisories/GHSA-5486-384g-mcx2	x_refsource_CONFIRM
https://github.com/element-hq/element-web/commit/a00c343435d633e64de2c0548217aa611c7bbef5	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-51749
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-51749

History

Created	Old Value	New Value	Data Type	Notes
2024-11-13 13:07:13				Added to TrackCVE