CVE-2021-40823
Last modified
CVE-2021-40823 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.. EPSS estimates a 0.64% chance of exploitation in the next 30 days.
Description
A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Matrix | Javascript Sdk | < 12.4.1 |
References
- https://github.com/matrix-org/matrix-js-sdk/releases/tag/v12.4.1Third Party Advisory
- https://github.com/matrix-org/matrix-js-sdk/releases/tag/v12.4.1Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-40823?
How severe is CVE-2021-40823?
How do I fix CVE-2021-40823?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-40812The GD Graphics Library (aka LibGD) through 2.3.2 has an out…6.5
- CVE-2021-40813A cross-site scripting (XSS) vulnerability in the "Zip conte…5.4
- CVE-2021-40814The Customer Photo Gallery addon before 2.9.4 for PrestaShop…9.8
- CVE-2021-40818scheme/webauthn.c in Glewlwyd SSO server through 2.5.3 has a…9.8
- CVE-2021-4082pimcore is vulnerable to Cross-Site Request Forgery (CSRF)4.3
- CVE-2021-40822GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SS…7.5
- CVE-2021-40824A logic error in the room key sharing functionality of Eleme…5.9
- CVE-2021-40825nLight ECLYPSE (nECY) system Controllers running software pr…8.6
- CVE-2021-40826Clementine Music Player through 1.3.1 is vulnerable to a Use…7.8
- CVE-2021-40827Clementine Music Player through 1.3.1 (when a GLib 2.0.0 DLL…7.8
- CVE-2021-40828Connections initialized by the AWS IoT Device SDK v2 for Jav…8.8
- CVE-2021-40829Connections initialized by the AWS IoT Device SDK v2 for Jav…8.8
Are you affected by CVE-2021-40823?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST