CVE-2024-26131

Katalog CVE

CVSS 7.8 · High EPSS 0,47%

Kerentanan Improper Restriction of Communication Channel to Intended Endpoints pada element. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious application to start any internal activity by passing some extra parameters. Possible impact includes making Element Android display an arbitrary web page, executing arbitrary JavaScript; bypassing PIN code protection; and account takeover by spawning a login screen to send credentials to an arbitrary home server. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.

Rincian

Terbit di NVD

29 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-923: Improper Restriction of Communication Channel to Intended Endpoints
CWE-940: Improper Verification of Source of a Communication Channel

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 39,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/element-hq/element-android/security/advisories/GHSA-j6pr-fpc8-q9vm patch · advisory vendor
• https://github.com/element-hq/element-android/commit/53734255ec270b0814946350787393dfcaa2a5a9 patch
• https://element.io/blog/security-release-element-android-1-6-12 release notes
• https://support.google.com/faqs/answer/9267555?hl=en deskripsi teknis