CVE-2022-41904 - Vulnerability Details - OpenCVE

Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly (with warning shields). Therefore a malicious homeserver could inject messages into the room without the user being alerted that the messages were not sent by a verified group member, even if the user has previously verified all group members. This issue has been patched in Element iOS 1.9.7. There are currently no known workarounds.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00106.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Element	Element

Configuration 1 [-]

cpe:2.3:a:element:element:*:*:*:*:*:iphone_os:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/vector-im/element-ios/releases/tag/v1.9.7
https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323g

History

Wed, 23 Apr 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-11-11T00:00:00.000Z

Updated: 2025-04-23T16:37:58.199Z

Reserved: 2022-09-30T00:00:00.000Z

Link: CVE-2022-41904

Vulnrichment

Updated: 2024-08-03T12:56:38.521Z

NVD

Status : Modified

Published: 2022-11-11T19:15:11.483

Modified: 2024-11-21T07:24:02.153

Link: CVE-2022-41904

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-41904", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "dateUpdated": "2025-04-23T16:37:58.199Z", "dateReserved": "2022-09-30T00:00:00.000Z", "datePublished": "2022-11-11T00:00:00.000Z"}, "containers": {"cna": {"title": "Element iOS is vulnerable due to missing decoration for events decrypted with untrusted Megolm sessions", "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-11-11T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly (with warning shields). Therefore a malicious homeserver could inject messages into the room without the user being alerted that the messages were not sent by a verified group member, even if the user has previously verified all group members. This issue has been patched in Element iOS 1.9.7. There are currently no known workarounds."}], "affected": [{"vendor": "vector-im", "product": "element-ios", "versions": [{"version": "< 1.9.7", "status": "affected"}]}], "references": [{"url": "https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323g"}, {"url": "https://github.com/vector-im/element-ios/releases/tag/v1.9.7"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-357: Insufficient UI Warning of Dangerous Operations", "cweId": "CWE-357"}]}], "source": {"advisory": "GHSA-fm8m-99j7-323g", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:56:38.521Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323g", "tags": ["x_transferred"]}, {"url": "https://github.com/vector-im/element-ios/releases/tag/v1.9.7", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T13:54:43.115863Z", "id": "CVE-2022-41904", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T16:37:58.199Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323g", "tags": ["x_transferred"]}, {"url": "https://github.com/vector-im/element-ios/releases/tag/v1.9.7", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:56:38.521Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-41904", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-23T13:54:43.115863Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T13:54:44.375Z"}}], "cna": {"title": "Element iOS is vulnerable due to missing decoration for events decrypted with untrusted Megolm sessions", "source": {"advisory": "GHSA-fm8m-99j7-323g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "vector-im", "product": "element-ios", "versions": [{"status": "affected", "version": "< 1.9.7"}]}], "references": [{"url": "https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323g"}, {"url": "https://github.com/vector-im/element-ios/releases/tag/v1.9.7"}], "descriptions": [{"lang": "en", "value": "Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly (with warning shields). Therefore a malicious homeserver could inject messages into the room without the user being alerted that the messages were not sent by a verified group member, even if the user has previously verified all group members. This issue has been patched in Element iOS 1.9.7. There are currently no known workarounds."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-357", "description": "CWE-357: Insufficient UI Warning of Dangerous Operations"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-11-11T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-41904", "state": "PUBLISHED", "dateUpdated": "2025-04-23T16:37:58.199Z", "dateReserved": "2022-09-30T00:00:00.000Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2022-11-11T00:00:00.000Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:element:element:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "F9B4C119-5BAB-4A44-9E43-A9EB1002FD31", "versionEndExcluding": "1.9.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly (with warning shields). Therefore a malicious homeserver could inject messages into the room without the user being alerted that the messages were not sent by a verified group member, even if the user has previously verified all group members. This issue has been patched in Element iOS 1.9.7. There are currently no known workarounds."}, {"lang": "es", "value": "Element iOS es un cliente iOS Matrix proporcionado por Element. Est\u00e1 basado en MatrixSDK. Antes de la versi\u00f3n 1.9.7, los eventos cifrados con Megolm para los cuales no se pod\u00eda establecer confianza no se decoraban en consecuencia (con escudos de advertencia). Por lo tanto, un servidor dom\u00e9stico malicioso podr\u00eda inyectar mensajes en la sala sin que el usuario sea alertado de que los mensajes no fueron enviados por un miembro verificado del grupo, incluso si el usuario ha verificado previamente a todos los miembros del grupo. Este problema se solucion\u00f3 en Element iOS 1.9.7. Actualmente no se conocen workarounds."}], "id": "CVE-2022-41904", "lastModified": "2024-11-21T07:24:02.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-11-11T19:15:11.483", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/vector-im/element-ios/releases/tag/v1.9.7"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323g"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/vector-im/element-ios/releases/tag/v1.9.7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-357"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}