CVE-2024-26132

Katalog CVE

CVSS 3.3 · Low EPSS 0,39%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada element. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force Element Android, version 0.91.0 through 1.6.12, to share files stored under the `files` directory in the application's private data directory to an arbitrary room. The impact of the attack is reduced by the fact that the databases stored in this folder are encrypted. However, it contains some other potentially sensitive information, such as the FCM token. Forks of Element Android which have set `android:exported="false"` in the `AndroidManifest.xml` file for the `IncomingShareActivity` activity are not impacted. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.

Rincian

Terbit di NVD

29 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/element-hq/element-android/security/advisories/GHSA-8wj9-cx7h-pvm4 patch · advisory vendor
• https://element.io/blog/security-release-element-android-1-6-12 patch · release notes
• https://github.com/element-hq/element-android/commit/8f9695a9a8d944cb9b92568cbd76578c51d32e07 patch