CVE-2024-26131
Element Android Intent Redirection
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious application to start any internal activity by passing some extra parameters. Possible impact includes making Element Android display an arbitrary web page, executing arbitrary JavaScript; bypassing PIN code protection; and account takeover by spawning a login screen to send credentials to an arbitrary home server. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.
Element Android es un cliente Matrix de Android. Element Android versión 1.4.3 a 1.6.10 es vulnerable a la redirección de intención, lo que permite que una aplicación maliciosa de terceros inicie cualquier actividad interna pasando algunos parámetros adicionales. El posible impacto incluye hacer que Element Android muestre una página web arbitraria, ejecutando JavaScript arbitrario; eludir la protección del código PIN; y toma de control de cuentas generando una pantalla de inicio de sesión para enviar credenciales a un servidor doméstico arbitrario. Este problema se solucionó en Element Android 1.6.12. No se conoce ningún workaround para mitigar el problema.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-02-14 CVE Reserved
- 2024-02-20 CVE Published
- 2024-02-21 EPSS Updated
- 2024-08-01 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-923: Improper Restriction of Communication Channel to Intended Endpoints
- CWE-940: Improper Verification of Source of a Communication Channel
CAPEC
References (4)
URL | Tag | Source |
---|---|---|
https://element.io/blog/security-release-element-android-1-6-12 | X_refsource_misc | |
https://github.com/element-hq/element-android/commit/53734255ec270b0814946350787393dfcaa2a5a9 | X_refsource_misc | |
https://github.com/element-hq/element-android/security/advisories/GHSA-j6pr-fpc8-q9vm | X_refsource_confirm | |
https://support.google.com/faqs/answer/9267555?hl=en | X_refsource_misc |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Element-hq Search vendor "Element-hq" | Element-android Search vendor "Element-hq" for product "Element-android" | >= 1.4.3 < 1.6.12 Search vendor "Element-hq" for product "Element-android" and version " >= 1.4.3 < 1.6.12" | en |
Affected
|