SUSE CVE-2024-50336

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the...

Directory Traversal

matrix-js-sdk is vulnerable to Directory Traversal. The vulnerability is due to insufficient validation of crafted MXC URIs, allowing a malicious room member to trigger arbitrary authenticated GET requests to the client's homeserver...

FreeBSD : Matrix clients -- mxc uri validation in js sdk (574f7bc9-a141-11ef-84e9-901b0e9408dc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 574f7bc9-a141-11ef-84e9-901b0e9408dc advisory. matrix-js-sdk upstream reports: matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversa...

matrix-react-sdk (>=3.102.0-rc.0, <=3.114.0) potentially affected by CVE-2024-50336 via matrix-js-sdk (>=34.0.0-rc.0, <=34.9.0-rc.0)

matrix-js-sdk NPM version =34.0.0-rc.0, =3.102.0-rc.0, =3.114.0 Source cves: CVE-2024-50336 Source advisory: OSV:GHSA-XVG8-M4X3-W6XR...

GHSA-XVG8-M4X3-W6XR matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

Summary matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Details The Matrix specification demands...

matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

Summary matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Details The Matrix specification demands...

matrix-react-sdk (>=3.102.0-rc.0, <=3.114.0) potentially affected by CVE-2024-50336 via matrix-js-sdk (>=34.0.0-rc.0, <=34.9.0-rc.0)

matrix-js-sdk NPM version =34.0.0-rc.0, =3.102.0-rc.0, =3.114.0 Source cves: CVE-2024-50336 Source advisory: GHSA-XVG8-M4X3-W6XR...

@airgap/beacon-sdk (>=0.0.1-beta.0, <=0.3.0), @caelum-tech/lorena-matrix-client (>=1.3.0, <=2.1.2) +70 more potentially affected by CVE-2024-50336 via matrix-js-sdk (>=0.0.4, <=34.9.0-rc.0)

matrix-js-sdk NPM version =0.0.4, =0.0.1-beta.0, =1.3.0, =1.0.0, =2.0.0, =2.0.0-alpha.3, =2.0.0-alpha.1, =1.4.1, =2.5.0, =0.0.1, =0.0.14, =0.0.1, =2.10.1, =0.0.0-development, =0.17.0, =4.0.1, =4.0.2 and more Source cves: CVE-2024-50336 Source advisory: MEND:CVE-2024-50336...

CVE-2024-50336 matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the...

CVE-2024-50336 matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the...

CVE-2024-50336

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the...

CVE-2024-50336: Improper Limitation of a Pathname to a Restricted Directory

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the...

matrix-js-sdk security vulnerabilities

matrix-js-sdk is an application component of Matrix open source. A security vulnerability exists in matrix-js-sdk versions prior to 34.11.1. An attacker can exploit this vulnerability to conduct a client-side path traversal attack via a specially crafted MXC URI...

Matrix clients -- mxc uri validation in js sdk

matrix-js-sdk upstream reports: matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver...

PT-2024-34149

Name of the Vulnerable Software and Affected Versions: matrix-js-sdk versions prior to 34.11.0 Description: The issue concerns a client-side path traversal vulnerability via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated G...

MatrixClient sendSharedHistoryKeys Authentication Bypass

The vulnerability of the MatrixClient.sendSharedHistoryKeys function in the JavaScript and TypeScript matrix-js-sdk development tools is related to insufficient protection of sensitive data. Exploiting this vulnerability could allow an attacker to bypass authentication procedures and gain...

Improper Authentication

matrix-js-sdk is vulnerable to Improper Authentication. The vulnerability is due to the method sendSharedHistoryKeys sends historical message keys to all devices of an invited user without checking if the user's cryptographic identity is verified or if the devices are signed by that identity,...

@dstny/scp-sdk (>=2.0.0, <=3.0.0-rc3), @elizaos/plugin-matrix (>=2.0.0-alpha.3, <=2.0.0-alpha.8) +33 more potentially affected by CVE-2024-47080 via matrix-js-sdk (>=9.11.0, <=34.7.0)

matrix-js-sdk NPM version =9.11.0, =2.0.0, =2.0.0-alpha.3, =2.0.0-alpha.1, =1.4.1, =2.5.0, =0.2.0, =0.0.14, =0.0.1, =0.0.0-development, =0.17.0, =4.0.1, =1.2.0, =0.1.14, =0.1.18, =0.2.4 - @zqbflynn/kernel 6.4.2 and more Source cves: CVE-2024-47080 Source advisory: GHSA-4JF8-G8WP-CX7C...

GHSA-4JF8-G8WP-CX7C Matrix JavaScript SDK's key history sharing could share keys to malicious devices

Impact In matrix-js-sdk versions 9.11.0 through 34.7.0, the method MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers. The method implements functionality proposed in MSC3061 and can be used by clients to share historical message keys with newly invited user...

@dstny/scp-sdk (>=2.0.0, <=3.0.0-rc3), @elizaos/plugin-matrix (>=2.0.0-alpha.3, <=2.0.0-alpha.8) +33 more potentially affected by CVE-2024-47080 via matrix-js-sdk (>=9.11.0, <=34.7.0)

matrix-js-sdk NPM version =9.11.0, =2.0.0, =2.0.0-alpha.3, =2.0.0-alpha.1, =1.4.1, =2.5.0, =0.2.0, =0.0.14, =0.0.1, =0.0.0-development, =0.17.0, =4.0.1, =1.2.0, =0.1.14, =0.1.18, =0.2.4 - @zqbflynn/kernel 6.4.2 and more Source cves: CVE-2024-47080 Source advisory: OSV:GHSA-4JF8-G8WP-CX7C...