// For flags

CVE-2024-26131

Element Android Intent Redirection

Severity Score

8.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious application to start any internal activity by passing some extra parameters. Possible impact includes making Element Android display an arbitrary web page, executing arbitrary JavaScript; bypassing PIN code protection; and account takeover by spawning a login screen to send credentials to an arbitrary home server. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.

Element Android es un cliente Matrix de Android. Element Android versión 1.4.3 a 1.6.10 es vulnerable a la redirección de intención, lo que permite que una aplicación maliciosa de terceros inicie cualquier actividad interna pasando algunos parámetros adicionales. El posible impacto incluye hacer que Element Android muestre una página web arbitraria, ejecutando JavaScript arbitrario; eludir la protección del código PIN; y toma de control de cuentas generando una pantalla de inicio de sesión para enviar credenciales a un servidor doméstico arbitrario. Este problema se solucionó en Element Android 1.6.12. No se conoce ningún workaround para mitigar el problema.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-02-14 CVE Reserved
  • 2024-02-20 CVE Published
  • 2024-02-21 EPSS Updated
  • 2024-08-01 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-923: Improper Restriction of Communication Channel to Intended Endpoints
  • CWE-940: Improper Verification of Source of a Communication Channel
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Element-hq
Search vendor "Element-hq"
Element-android
Search vendor "Element-hq" for product "Element-android"
>= 1.4.3 < 1.6.12
Search vendor "Element-hq" for product "Element-android" and version " >= 1.4.3 < 1.6.12"
en
Affected