VDB
CVE-2021-40824
CVE-2021-40824
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 (aka Matrix SDK for Android) before 1.2.2 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the attacker to decrypt end-to-end encrypted messages sent by affected clients.
EPSS 0.66% · 49.2th percentile
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.66%
49.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| matrix | matrix-android-sdk2 | 0 |
| n/a | n/a | n/a |
| matrix | element | 0 |
| Maven | org.matrix.android:matrix-android-sdk2 | 0 |
Timeline
- Sep 13, 2021 CVE Published
- Sep 14, 2021 EPSS Score
- Sep 24, 2021 CVE Updated
- Nov 11, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 6, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 3, 2022 EPSS Score
- Jun 29, 2022 EPSS Score
- Aug 27, 2022 EPSS Score
- Dec 21, 2022 EPSS Score