matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to
    version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To
    exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML
    injection payload. No cross-site scripting attack is possible due to the hardcoded content security
    policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will
    clear the HTML injection. (CVE-2023-30609)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c676bb1b-e3f8-11ed-b37b-901b0e9408dc advisory.

  - matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to     version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To     exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML     injection payload. No cross-site scripting attack is possible due to the hardcoded content security     policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will     clear the HTML injection. (CVE-2023-30609)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
420674	SCA: security update for matrix-react-sdk (GHSA-xv83-x443-7rmw)	Tenable Cloud Security	SCA Checks	medium
420674	SCA: security update for matrix-react-sdk (GHSA-xv83-x443-7rmw)	Tenable Self-Hosted Container Security	SCA Checks	medium
406930	Alpine: riot-web: security update to 1.11.30-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406930	Alpine: riot-web: security update to 1.11.30-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
404215	Alpine: element-web: security update to 1.11.30-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
404215	Alpine: element-web: security update to 1.11.30-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
174766	FreeBSD : element-web -- matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting (c676bb1b-e3f8-11ed-b37b-901b0e9408dc)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2023-30609

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium