Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTUybXEtNmpjdi1qNzl4
User content sandbox can be confused into opening arbitrary documents
Impact
The user content sandbox can be abused to trick users into opening unexpected documents after several user interactions. The content can be opened with a blob origin from the Matrix client, so it is possible for a malicious document to access user messages and secrets.
Patches
This has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5657, which is included in 3.15.0.
Workarounds
There are no known workarounds.
Permalink: https://github.com/advisories/GHSA-52mq-6jcv-j79xJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTUybXEtNmpjdi1qNzl4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: over 3 years ago
Updated: almost 2 years ago
CVSS Score: 2.6
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Identifiers: GHSA-52mq-6jcv-j79x, CVE-2021-21320
References:
- https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-52mq-6jcv-j79x
- https://github.com/matrix-org/matrix-react-sdk/pull/5657
- https://github.com/matrix-org/matrix-react-sdk/commit/b386f0c73b95ecbb6ea7f8f79c6ff5171a8dedd1
- https://nvd.nist.gov/vuln/detail/CVE-2021-21320
- https://www.npmjs.com/package/matrix-react-sdk
- https://github.com/advisories/GHSA-52mq-6jcv-j79x
Blast Radius: 4.9
Affected Packages
npm:matrix-react-sdk
Dependent packages: 7Dependent repositories: 78
Downloads: 6,924 last month
Affected Version Ranges: < 3.15.0
Fixed in: 3.15.0
All affected versions: 0.0.1, 0.0.2, 0.1.0, 0.2.0, 0.3.0, 0.3.1, 0.4.0, 0.5.0, 0.5.1, 0.5.2, 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.6.5, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.5, 0.8.6, 0.8.7, 0.8.8, 0.8.9, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5, 0.9.6, 0.9.7, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5, 0.10.6, 0.10.7, 0.11.0, 0.11.1, 0.11.2, 0.11.3, 0.11.4, 0.12.0, 0.12.1, 0.12.2, 0.12.3, 0.12.4, 0.12.5, 0.12.6, 0.12.7, 0.12.8, 0.12.9, 0.13.0, 0.13.1, 0.13.2, 0.13.3, 0.13.4, 0.13.5, 0.13.6, 0.14.0, 0.14.1, 0.14.2, 0.14.3, 0.14.4, 0.14.5, 0.14.6, 0.14.7, 0.14.8, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.3.0, 1.3.1, 1.4.0, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.6.0, 1.6.1, 1.6.2, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 2.0.0, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.3.0, 2.3.1, 2.5.0, 2.6.0, 2.6.1, 2.7.0, 2.7.1, 2.7.2, 2.8.0, 2.8.1, 2.9.0, 2.10.0, 2.10.1, 3.0.0, 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.6.0, 3.6.1, 3.7.0, 3.7.1, 3.8.0, 3.9.0, 3.10.0, 3.11.0, 3.11.1, 3.12.0, 3.12.1, 3.13.0, 3.13.1, 3.14.0
All unaffected versions: 3.15.0, 3.16.0, 3.17.0, 3.18.0, 3.19.0, 3.20.0, 3.21.0, 3.22.0, 3.23.0, 3.24.0, 3.25.0, 3.26.0, 3.27.0, 3.28.0, 3.28.1, 3.29.0, 3.29.1, 3.30.0, 3.31.0, 3.32.0, 3.32.1, 3.33.0, 3.34.0, 3.35.1, 3.36.0, 3.36.1, 3.37.0, 3.38.0, 3.39.0, 3.39.1, 3.40.0, 3.40.1, 3.41.0, 3.41.1, 3.42.0, 3.42.1, 3.42.3, 3.42.4, 3.43.0, 3.44.0, 3.45.0, 3.46.0, 3.47.0, 3.48.0, 3.49.0, 3.50.0, 3.51.0, 3.52.0, 3.53.0, 3.54.0, 3.55.0, 3.56.0, 3.57.0, 3.58.0, 3.58.1, 3.59.0, 3.59.1, 3.60.0, 3.61.0, 3.62.0, 3.63.0, 3.64.0, 3.64.1, 3.64.2, 3.65.0, 3.66.0, 3.67.0, 3.68.0, 3.69.0, 3.69.1, 3.70.0, 3.71.0, 3.71.1, 3.72.0, 3.73.0, 3.73.1, 3.74.0, 3.75.0, 3.76.0, 3.77.0, 3.77.1, 3.78.0, 3.79.0, 3.80.0, 3.80.1, 3.81.0, 3.81.1, 3.82.0, 3.83.0, 3.84.0, 3.84.1, 3.85.0, 3.86.0, 3.87.0, 3.88.0, 3.89.0, 3.90.0, 3.91.0, 3.92.0, 3.93.0, 3.94.0, 3.95.0, 3.96.0, 3.96.1, 3.97.0, 3.98.0, 3.99.0, 3.100.0, 3.101.0, 3.102.0, 3.103.0, 3.104.0, 3.105.1, 3.106.0, 3.107.0, 3.108.0, 3.109.0, 3.110.0, 3.111.0, 3.112.0, 3.113.0, 3.114.0