CVE-2024-47771 Element Desktop vulnerable to potential exposure of access token via authenticated media
Attackers can expose access tokens via malicious widgets, potentially leading to account takeover in Element Desktop.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-47771?
CVE-2024-47771 is a high-severity vulnerability in element-hq element-desktop, published on 15 Oct 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.
Weakness: CWE-200
Which versions are affected by CVE-2024-47771?
Linux distribution packages (2)
element-desktop openSUSE:Tumbleweed | All versions | 1.11.81-1.1 |
element-web openSUSE:Tumbleweed | All versions | 1.11.81-1.1 |
How do I fix CVE-2024-47771?
Upgrade to a fixed version.
Is CVE-2024-47771 being exploited?
There is no known exploitation of CVE-2024-47771 in the wild and no public exploit code.
Sources
Also known as GHSA-963w-49j9-gxj6, openSUSE-SU-2024:14406-1, openSUSE-SU-2024:14407-1.