CVE-2024-51750CWE-248

Element allows a malicious homeserver can modify events leading to unrenderable events or rooms

Medium · published November 12, 2024

CVSS v3.1
5.0
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can prevent Element Web and Desktop from rendering single messages or the entire room containing them. This was patched in Element Web and Desktop 1.11.85.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00497 · 41.7th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2024-11-12T16:34Z
EPSS history
Timeline
  • 12 NOV 16:34Z
    Element allows a malicious homeserver can modify events leading to unrenderable events or rooms
    cvelistv5