Information Exposure Affecting matrix-js-sdk package, versions <12.4.1
Threat Intelligence
EPSS
0.08% (37th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-MATRIXJSSDK-1584628
- published 14 Sep 2021
- disclosed 14 Sep 2021
- credit Denis Kasak
Introduced: 14 Sep 2021
CVE-2021-40823 Open this link in a new tabHow to fix?
Upgrade matrix-js-sdk to version 12.4.1 or higher.
Overview
matrix-js-sdk is a Matrix Client-Server SDK for Javascript
Affected versions of this package are vulnerable to Information Exposure. It may be possible to trick vulnerable clients into disclosing encryption keys for messages previously sent by that client to user accounts later compromised by an attacker.
References
CVSS Scores
version 3.1