CVE-2024-42347

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-42347
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42347.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-42347
Aliases
Downstream
Related
Published
2024-08-06T17:16:14.143Z
Modified
2025-12-05T05:57:31.619744Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
URL preview setting for a room is controllable by the homeserver in matrix-react-sdk
Details

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the server. This was patched in matrix-react-sdk 3.105.0. Deployments that trust their homeservers, as well as closed federations of trusted servers, are not affected. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42347.json",
    "cwe_ids": [
        "CWE-359"
    ]
}
References

Affected packages

Git / github.com/matrix-org/matrix-react-sdk

Affected ranges

Type
GIT
Repo
https://github.com/matrix-org/matrix-react-sdk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
25e67beab6d2525fdc1adf4467b6f0da01415470

Affected versions

Other

no-media-devices-release

v0.*

v0.0.2
v0.1.0
v0.1.1
v0.10.1
v0.10.1-rc.1
v0.10.2
v0.10.3
v0.10.3-rc.1
v0.10.3-rc.2
v0.10.4
v0.10.4-rc.1
v0.10.5
v0.10.6
v0.10.7
v0.10.7-rc.1
v0.10.7-rc.2
v0.10.7-rc.3
v0.11.0
v0.11.0-rc.1
v0.11.0-rc.2
v0.11.0-rc.3
v0.11.1
v0.11.2
v0.11.3
v0.11.4
v0.12.0
v0.12.0-rc.1
v0.12.0-rc.2
v0.12.0-rc.3
v0.12.0-rc.4
v0.12.0-rc.5
v0.12.0-rc.6
v0.12.0-rc.7
v0.12.1
v0.12.2
v0.12.3
v0.12.3-rc.1
v0.12.3-rc.2
v0.12.3-rc.3
v0.12.4
v0.12.4-rc.1
v0.12.4-rc.2
v0.12.4-rc.3
v0.12.4-rc.4
v0.12.4-rc.5
v0.12.4-rc.6
v0.12.5
v0.12.6
v0.12.6-rc.1
v0.12.7
v0.12.7-rc.1
v0.12.8
v0.12.8-rc.1
v0.12.8-rc.2
v0.12.9
v0.12.9-rc.1
v0.12.9-rc.2
v0.13.0
v0.13.0-rc.1
v0.13.0-rc.2
v0.13.1
v0.13.1-rc.1
v0.13.2
v0.13.3
v0.13.3-rc.1
v0.13.3-rc.2
v0.13.4
v0.13.4-rc.1
v0.13.5
v0.13.5-rc.1
v0.13.6
v0.14.0
v0.14.0-rc.1
v0.14.1
v0.14.2
v0.14.2-rc.1
v0.14.3
v0.14.4
v0.14.5
v0.14.5-rc.1
v0.14.5-rc.2
v0.14.6
v0.14.7
v0.14.7-rc.1
v0.14.7-rc.2
v0.14.8
v0.14.8-rc.1
v0.2.0
v0.3.0
v0.3.1
v0.4.0
v0.5.0
v0.5.1
v0.5.2
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.6.4
v0.6.4-r1
v0.6.5
v0.6.5-r1
v0.6.5-r2
v0.6.5-r3
v0.7.0-rc1
v0.7.0-rc2
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.5-rc.1
v0.8.0
v0.8.1
v0.8.1-rc.1
v0.8.1-rc.2
v0.8.2
v0.8.3
v0.8.3-electron
v0.8.4
v0.8.5
v0.8.5-rc.1
v0.8.6
v0.8.6-rc.1
v0.8.6-rc.2
v0.8.6-rc.3
v0.8.7
v0.8.7-rc.1
v0.8.7-rc.2
v0.8.7-rc.3
v0.8.7-rc.4
v0.8.8
v0.8.8-rc.1
v0.8.8-rc.2
v0.8.9
v0.8.9-rc.1
v0.9.0
v0.9.0-rc.1
v0.9.0-rc.2
v0.9.1
v0.9.2
v0.9.3
v0.9.3-rc.1
v0.9.3-rc.2
v0.9.4
v0.9.5
v0.9.5-rc.1
v0.9.5-rc.2
v0.9.6
v0.9.7

v1.*

v1.0.0
v1.0.0-rc.1
v1.0.0-rc.2
v1.0.1
v1.0.2
v1.0.2-rc.1
v1.0.2-rc.2
v1.0.2-rc.3
v1.0.2-rc.4
v1.0.3
v1.0.4
v1.0.4-rc.1
v1.0.5
v1.0.6
v1.0.6-rc.1
v1.0.7
v1.1.0
v1.1.0-rc.1
v1.1.1
v1.1.2
v1.2.0
v1.2.0-rc.1
v1.2.1
v1.2.2
v1.2.2-rc.1
v1.2.2-rc.2
v1.3.0
v1.3.0-rc.1
v1.3.1
v1.4.0
v1.4.0-rc.1
v1.4.0-rc.2
v1.4.0-rc.3
v1.5.0
v1.5.0-rc.1
v1.5.1
v1.5.2
v1.5.2-rc.1
v1.5.3
v1.5.3-rc.1
v1.5.3-rc.2
v1.5.3-rc.3
v1.6.0
v1.6.0-rc.1
v1.6.0-rc.2
v1.6.1
v1.6.2
v1.6.2-rc.1
v1.7.0
v1.7.0-rc.1
v1.7.1
v1.7.1-rc.1
v1.7.1-rc.2
v1.7.2
v1.7.3
v1.7.3-rc.1
v1.7.3-rc.2
v1.7.4
v1.7.5
v1.7.5-rc.1
v1.7.6
v1.7.6-rc.1
v1.7.6-rc.2

v2.*

v2.0.0
v2.0.0-rc.1
v2.0.0-rc.2
v2.1.0
v2.1.0-rc.1
v2.1.0-rc.2
v2.1.1
v2.10.0
v2.10.1
v2.2.0
v2.2.0-rc.1
v2.2.1
v2.2.2
v2.2.3
v2.2.3-rc.1
v2.3.0
v2.3.0-rc.1
v2.3.1
v2.4.0-rc.1
v2.5.0
v2.5.0-rc.1
v2.5.0-rc.2
v2.5.0-rc.3
v2.5.0-rc.4
v2.5.0-rc.5
v2.5.0-rc.6
v2.6.0
v2.6.0-rc.1
v2.6.1
v2.7.0
v2.7.0-rc.1
v2.7.0-rc.2
v2.7.1
v2.7.2
v2.8.0
v2.8.0-rc.1
v2.8.1
v2.9.0
v2.9.0-rc.1

v3.*

v3.0.0
v3.1.0
v3.1.0-rc.1
v3.10.0
v3.10.0-rc.1
v3.100.0
v3.100.0-rc.0
v3.100.0-rc.1
v3.101.0
v3.101.0-rc.0
v3.101.0-rc.1
v3.102.0
v3.102.0-rc.0
v3.102.0-rc.1
v3.103.0
v3.103.0-rc.0
v3.103.0-rc.1
v3.104.0
v3.104.0-rc.0
v3.104.0-rc.1
v3.105.0
v3.11.0
v3.11.0-rc.1
v3.11.0-rc.2
v3.11.1
v3.12.0
v3.12.0-rc.1
v3.12.1
v3.13.0
v3.13.0-rc.1
v3.13.1
v3.14.0
v3.14.0-rc.1
v3.15.0
v3.15.0-rc.1
v3.16.0
v3.16.0-rc.1
v3.16.0-rc.2
v3.17.0
v3.17.0-rc.1
v3.18.0
v3.18.0-rc.1
v3.19.0
v3.19.0-rc.1
v3.2.0
v3.2.0-rc.1
v3.20.0
v3.20.0-rc.1
v3.21.0
v3.21.0-rc.1
v3.22.0
v3.22.0-rc.1
v3.23.0
v3.23.0-rc.1
v3.24.0
v3.24.0-rc.1
v3.25.0
v3.25.0-rc.1
v3.26.0
v3.26.0-rc.1
v3.27.0
v3.27.0-rc.1
v3.28.0
v3.28.0-rc.1
v3.28.1
v3.29.0
v3.29.0-rc.1
v3.29.0-rc.2
v3.29.0-rc.3
v3.29.1
v3.3.0
v3.3.0-rc.1
v3.30.0
v3.30.0-rc.1
v3.30.0-rc.2
v3.31.0
v3.31.0-rc.1
v3.31.0-rc.2
v3.32.0
v3.32.0-rc.1
v3.32.0-rc.2
v3.32.1
v3.33.0
v3.33.0-rc.1
v3.33.0-rc.2
v3.34.0
v3.34.0-rc.1
v3.35.0
v3.35.0-rc.1
v3.35.1
v3.36.0
v3.36.0-rc.1
v3.36.1
v3.37.0
v3.37.0-rc.1
v3.38.0
v3.38.0-rc.1
v3.39.0
v3.39.0-rc.1
v3.39.0-rc.2
v3.39.1
v3.4.0
v3.4.0-rc.1
v3.4.1
v3.40.0
v3.40.0-rc.1
v3.40.0-rc.2
v3.40.1
v3.41.0
v3.41.0-rc.1
v3.41.1
v3.42.0
v3.42.0-rc.1
v3.42.1
v3.42.1-rc.1
v3.42.2-rc.1
v3.42.3
v3.42.4
v3.43.0
v3.43.0-rc.1
v3.44.0
v3.44.0-rc.1
v3.44.0-rc.2
v3.45.0
v3.45.0-rc.1
v3.45.0-rc.2
v3.45.0-rc.3
v3.46.0
v3.46.0-rc.1
v3.47.0
v3.48.0
v3.48.0-rc.1
v3.49.0
v3.49.0-rc.1
v3.49.0-rc.2
v3.5.0
v3.5.0-rc.1
v3.50.0
v3.51.0
v3.51.0-rc.1
v3.52.0
v3.52.0-rc.1
v3.52.0-rc.2
v3.53.0
v3.53.0-rc.1
v3.53.0-rc.2
v3.54.0
v3.54.0-rc.1
v3.55.0
v3.55.0-rc.1
v3.56.0
v3.57.0
v3.58.0
v3.58.0-rc.1
v3.58.0-rc.2
v3.58.1
v3.59.0
v3.59.0-rc.1
v3.59.0-rc.2
v3.59.1
v3.6.0
v3.6.0-rc.1
v3.6.1
v3.60.0
v3.60.0-rc.1
v3.60.0-rc.2
v3.61.0
v3.61.0-rc.1
v3.62.0
v3.62.0-rc.1
v3.62.0-rc.2
v3.63.0
v3.63.0-rc.1
v3.63.0-rc.2
v3.64.0
v3.64.0-rc.1
v3.64.0-rc.2
v3.64.0-rc.3
v3.64.0-rc.4
v3.64.1
v3.64.2
v3.65.0
v3.65.0-rc.1
v3.66.0
v3.66.0-rc.1
v3.67.0
v3.67.0-rc.1
v3.67.0-rc.2
v3.68.0
v3.68.0-rc.1
v3.68.0-rc.2
v3.68.0-rc.3
v3.69.0
v3.69.1
v3.7.0
v3.7.0-rc.1
v3.7.0-rc.2
v3.7.1
v3.70.0
v3.70.0-rc.1
v3.71.0
v3.71.0-rc.1
v3.71.1
v3.72.0
v3.72.0-rc.1
v3.72.0-rc.2
v3.73.0
v3.73.0-rc.1
v3.73.0-rc.2
v3.73.0-rc.3
v3.73.1
v3.74.0
v3.74.0-rc1
v3.75.0
v3.75.0-no-media-devices-hotfix
v3.75.0-rc.1
v3.76.0
v3.76.0-rc.1
v3.76.0-rc.2
v3.77.0
v3.77.0-rc.1
v3.77.1
v3.78.0
v3.78.0-rc.1
v3.79.0
v3.79.0-rc.1
v3.79.0-rc.2
v3.8.0
v3.8.0-rc.1
v3.80.0
v3.80.0-rc.1
v3.80.0-rc.2
v3.80.1
v3.81.0
v3.81.0-rc.1
v3.81.1
v3.82.0
v3.82.0-rc.1
v3.83.0
v3.83.0-rc.1
v3.84.0
v3.84.0-rc.1
v3.84.1
v3.85.0
v3.85.0-rc.0
v3.85.0-rc.1
v3.86.0
v3.86.0-rc.0
v3.86.0-rc.1
v3.86.0-rc.2
v3.87.0
v3.87.0-rc.0
v3.88.0
v3.89.0
v3.89.0-rc.0
v3.9.0
v3.9.0-rc.1
v3.90.0
v3.91.0
v3.91.0-rc.0
v3.91.0-rc.1
v3.92.0
v3.92.0-rc.0
v3.92.0-rc.1
v3.93.0
v3.93.0-rc.0
v3.94.0
v3.94.0-rc.0
v3.95.0
v3.95.0-rc.0
v3.96.0
v3.96.0-rc.0
v3.96.1
v3.97.0
v3.97.0-rc.0
v3.98.0
v3.98.0-rc.0
v3.99.0
v3.99.0-rc.0
v3.99.0-rc.1