CVE-2022-41904: element

csirt@kutim:~/threat-intel/cve/CVE-2022-41904

CVSS 6.5 · Medium EPSS 0,45%

Kerentanan Insufficient UI Warning of Dangerous Operations pada element. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly (with warning shields). Therefore a malicious homeserver could inject messages into the room without the user being alerted that the messages were not sent by a verified group member, even if the user has previously verified all group members. This issue has been patched in Element iOS 1.9.7. There are currently no known workarounds.

Rincian

Terbit di NVD: 11 November 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-357: Insufficient UI Warning of Dangerous Operations
EPSS (30 hari): 0,45% peluang dieksploitasi; lebih tinggi dari 37,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
element	element	Semua versi sebelum 1.9.7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/vector-im/element-ios/releases/tag/v1.9.7 release notes · advisory pihak ketiga
https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323g advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.