CVE-2024-51749
Element's thumbnails can be abused to misrepresent the content of an attachment
- State
- Published
- Severity
- 3.5 Low
- Published
- Nov 12, 2024
- Updated
- Nov 12, 2024
- Reserved
- Oct 31, 2024
Description
Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file download once clicked. Fixed in element-web 1.11.85.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.5 Low | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N | GitHub_M |
Weaknesses
- CWE-451 User Interface (UI) Misrepresentation of Critical Information
Affected Products
| Product | Versions |
|---|---|
element-webelement-hq |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.