CVE-2021-32622 MEDIUM

CVE-2021-32622: File upload local preview can run embedded scripts after user interaction

Vendor Matrix-Org
Product matrix-react-sdk
Weakness CWE-74
Published May 17, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

4.2/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.

Key dates

02Disclosure timeline

May 17, 2021 CVE published
August 3, 2024 Record updated