Information disclosure in Element-Hq Element-Desktop
CVE-2024-47771
Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.
Vulnerability class: Information Disclosure
EPSS: 0.006 (44.8th percentile) — read the EPSS interpretation.
Affected products
- Element-hq Element-desktop — versions >= 1.11.70, < 1.11.81
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-47771?
- CVE-2024-47771 is a vulnerability in Element-Hq Element-Desktop, classified under Information Disclosure. Published 2024-10-15.
- Is CVE-2024-47771 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.