« Volver al listado

CVE-2024-51749

Estado: AplazadaBaja (3.5)—

Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file download once clicked. Fixed in element-web 1.11.85.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Element — DesktopAIElement — Element WEBAIElement — Matrix React SDKAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-51749",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-51749",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-12T17:14:12.000969Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.5,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "element-hq",
          "product": "element-web",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.11.85"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-11-12T17:15:09.910",
  "references": [
    {
      "url": "https://github.com/element-hq/element-web/commit/a00c343435d633e64de2c0548217aa611c7bbef5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/element-hq/element-web/security/advisories/GHSA-5486-384g-mcx2",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-451"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file download once clicked. Fixed in element-web 1.11.85."
    },
    {
      "lang": "es",
      "value": "Element es un cliente web de Matrix creado con el SDK de Matrix React. Las versiones de Element Web y Desktop anteriores a la 1.11.85 no comprueban si las miniaturas de los archivos adjuntos, las pegatinas y las imágenes son coherentes. Es posible añadir miniaturas a eventos que activen la descarga de un archivo al hacer clic en ellos. Se ha corregido en element-web 1.11.85."
    }
  ],
  "lastModified": "2026-06-17T08:06:14.683",
  "sourceIdentifier": "security-advisories@github.com"
}