What is GHSA-f83w-wqhc-cfp4?

GHSA-f83w-wqhc-cfp4 is a security advisory published by GitHub Security Advisories with Medium severity. Matrix SDK for React's URL preview setting for a room is controllable by the homeserver

Which CVE IDs does GHSA-f83w-wqhc-cfp4 cover?

GHSA-f83w-wqhc-cfp4 covers the following CVE IDs: CVE-2024-42347. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f83w-wqhc-cfp4?

GHSA-f83w-wqhc-cfp4 has a CVSS v3 base score of 4.1, published by GitHub Security Advisories.

Which products are affected by GHSA-f83w-wqhc-cfp4?

GHSA-f83w-wqhc-cfp4 affects 1 product, including: npm/matrix-react-sdk:\u003c 3.105.1.

GHSA-f83w-wqhc-cfp4MediumCVSS 4.1

Matrix SDK for React's URL preview setting for a room is controllable by the homeserver

Vendor

GitHub Security Advisories

Published

August 6, 2024

Last Modified

August 8, 2024

🔗 CVE IDs covered (1)

CVE-2024-42347 →

📋 Description

Impact

A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the server.

Even if the CVSS score would be 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) the maintainer classifies this as High severity issue.

Patches

This was patched in matrix-react-sdk 3.105.1.

Workarounds

Deployments that trust their homeservers, as well as closed federations of trusted servers, are not affected.

References

N/A.

🎯 Affected products1

npm/matrix-react-sdk:< 3.105.1

🔗 References (4)

https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-f83w-wqhc-cfp4
https://nvd.nist.gov/vuln/detail/CVE-2024-42347
https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.105.1
https://github.com/advisories/GHSA-f83w-wqhc-cfp4