CVE-2022-41904

Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly (with warning shields). Therefore a malicious homeserver could inject messages into the room without the user being alerted that the messages were not sent by a verified group member, even if the user has previously verified all group members. This issue has been patched in Element iOS 1.9.7. There are currently no known workarounds.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/vector-im/element-ios/releases/tag/v1.9.7	Release Notes Third Party Advisory
https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323g	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:element:element:*:*:*:*:*:iphone_os:*:*

History

No history.

Information

Published : 2022-11-11 19:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-41904

Mitre link : CVE-2022-41904

CVE.ORG link : CVE-2022-41904

JSON object : View

Products Affected

element

element

CWE

NVD-CWE-Other CWE-357

Insufficient UI Warning of Dangerous Operations

{"id": "CVE-2022-41904", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.1}]}, "published": "2022-11-11T19:15:11.483", "references": [{"url": "https://github.com/vector-im/element-ios/releases/tag/v1.9.7", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323g", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-357"}]}], "descriptions": [{"lang": "en", "value": "Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly (with warning shields). Therefore a malicious homeserver could inject messages into the room without the user being alerted that the messages were not sent by a verified group member, even if the user has previously verified all group members. This issue has been patched in Element iOS 1.9.7. There are currently no known workarounds."}, {"lang": "es", "value": "Element iOS es un cliente iOS Matrix proporcionado por Element. Est\u00e1 basado en MatrixSDK. Antes de la versi\u00f3n 1.9.7, los eventos cifrados con Megolm para los cuales no se pod\u00eda establecer confianza no se decoraban en consecuencia (con escudos de advertencia). Por lo tanto, un servidor dom\u00e9stico malicioso podr\u00eda inyectar mensajes en la sala sin que el usuario sea alertado de que los mensajes no fueron enviados por un miembro verificado del grupo, incluso si el usuario ha verificado previamente a todos los miembros del grupo. Este problema se solucion\u00f3 en Element iOS 1.9.7. Actualmente no se conocen workarounds."}], "lastModified": "2022-11-16T16:56:41.030", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:element:element:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "F9B4C119-5BAB-4A44-9E43-A9EB1002FD31", "versionEndExcluding": "1.9.7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}