Vulnerability Description
matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a `blob` origin that cannot access Matrix user data, so messages and secrets are not at risk. This has been fixed in version 3.15.0.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Matrix-React-Sdk Project | Matrix-React-Sdk | < 3.15.0 |
Related Weaknesses (CWE)
References
- https://github.com/matrix-org/matrix-react-sdk/commit/b386f0c73b95ecbb6ea7f8f79cPatchThird Party Advisory
- https://github.com/matrix-org/matrix-react-sdk/pull/5657PatchThird Party Advisory
- https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-52mq-6jcThird Party Advisory
- https://www.npmjs.com/package/matrix-react-sdkProductThird Party Advisory
- https://github.com/matrix-org/matrix-react-sdk/commit/b386f0c73b95ecbb6ea7f8f79cPatchThird Party Advisory
- https://github.com/matrix-org/matrix-react-sdk/pull/5657PatchThird Party Advisory
- https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-52mq-6jcThird Party Advisory
- https://www.npmjs.com/package/matrix-react-sdkProductThird Party Advisory
FAQ
What is CVE-2021-21320?
CVE-2021-21320 is a vulnerability with a CVSS score of 2.6 (LOW). matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected ...
How severe is CVE-2021-21320?
CVE-2021-21320 has been rated LOW with a CVSS base score of 2.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-21320?
Check the references section above for vendor advisories and patch information. Affected products include: Matrix-React-Sdk Project Matrix-React-Sdk.