CVE-2022-41904 : Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encryp

Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly (with warning shields). Therefore a malicious homeserver could inject messages into the room without the user being alerted that the messages were not sent by a verified group member, even if the user has previously verified all group members. This issue has been patched in Element iOS 1.9.7. There are currently no known workarounds.

Published 2022-11-11 19:15:11

Updated 2022-11-16 16:56:41

Source GitHub, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-41904

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 26 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-41904

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	3.9	2.5	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None
6.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	3.1	2.7	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2022-41904

CWE-357 Insufficient UI Warning of Dangerous Operations

The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention.

Assigned by: security-advisories@github.com (Secondary)

References for CVE-2022-41904

https://github.com/vector-im/element-ios/releases/tag/v1.9.7

Release v1.9.7 · vector-im/element-ios · GitHub
Release Notes;Third Party Advisory
https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323g

Missing decoration for events decrypted with untrusted Megolm sessions · Advisory · vector-im/element-ios · GitHub
Third Party Advisory

Products affected by CVE-2022-41904

Element » Element » For Iphone Os
Versions before (<) 1.9.7
cpe:2.3:a:element:element:*:*:*:*:*:iphone_os:*:*
Matching versions

Vulnerability Details : CVE-2022-41904

Exploit prediction scoring system (EPSS) score for CVE-2022-41904

CVSS scores for CVE-2022-41904

CWE ids for CVE-2022-41904

References for CVE-2022-41904

Products affected by CVE-2022-41904