CVE-2024-47771 - CVE House

Back to Database

Status published High CVE-2024-47771

Element Desktop vulnerable to potential exposure of access token via authenticated media

7 CVSS

Vulnerability Description

Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47771

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from element-hq

View All →

Matrix Authentication Service account password can be changed using an authenticated session without supplying the current password

Synapse: Invalid device keys degrade federation functionality

In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left

Element Web could load a malicious instance of Element Call leaking media encryption keys

Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call

Affected Vendor

element-hq

View all reports →

Affected Software

element-desktop

Vulnerable Versions:

>= 1.11.70, < 1.11.81

Timeline

Official Publish: October 15th, 2024

Last Modified: October 15th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel