PT-2021-19814

CVE-2021-32622

Published

2021-05-17

Updated

2022-02-10

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Matrix-React-SDK versions prior to 3.21.0

Description The issue arises when uploading a file, as the local file preview can lead to the execution of scripts embedded in the uploaded file. This occurs after several user interactions to open the preview in a separate tab. The impact is limited to the local user during the upload process and cannot be exploited remotely or by other users.

Recommendations For versions prior to 3.21.0, update to version 3.21.0 to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-434: Unrestricted Upload of File with Dangerous Type

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers

CVE-2021-32622