Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Element Web could load a malicious instance of Element Call leaking media encryption keys
Vulnerability Description
Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used for an Element Call call. Version 1.11.97 fixes the problem.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Vulnerability Type
将系统数据暴露到未授权控制的范围
Vulnerability Title
Element 安全漏洞
Vulnerability Description
Element是Element开源的一个 Matrix 网络协作客户端。 Element 1.11.16至1.11.96版本存在安全漏洞，该漏洞源于配置允许从外部URL加载Element Call，导致媒体加密密钥泄露。
CVSS Information
N/A
Vulnerability Type
N/A