matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:4326-1 advisory.

    - CVE-2024-50336: Fixed insufficient MXC URI validation which could allow client-side path traversal     (bsc#1234413)

    Other fixes:
    - Updated to Mozilla Thunderbird 128.5.2i (bsc#1234413):
      * fixed: Large virtual folders could be very slow
      * fixed: Message could disappear after moving from IMAP folder         followed by Undo and Redo
      * fixed: XMPP chat did not display messages sent inside a CDATA         element
      * fixed: Selected calendar day did not move forward at midnight
      * fixed: Today pane agenda sometimes scrolled for no apparent         reason
      * fixed: CalDAV calendars without offline support could degrade         start-up performance
      * fixed: Visual and UX improvements
      * fixed: Security fixes

    - Updated to Mozilla Thunderbird 128.5.1:
      * new: Add end of year donation appeal
      * fixed: Total message count for favorite folders did not work         consistently

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-9b2a9cdf0b advisory.

    Update to 128.5.2

    * https://www.thunderbird.net/en-US/thunderbird/128.5.2esr/releasenotes/
    * https://www.mozilla.org/en-US/security/advisories/mfsa2024-69/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b32b4e1b88 advisory.

    Update to 128.5.2

    * https://www.thunderbird.net/en-US/thunderbird/128.5.2esr/releasenotes/
    * https://www.mozilla.org/en-US/security/advisories/mfsa2024-69/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mozilla-thunderbird installed on the remote host is prior to 128.5.2esr. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-346-01 advisory.

    New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix a security issue.

Tenable has extracted the preceding description block directly from the mozilla-thunderbird security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 128.5.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2024-69 advisory.

  - The Matrix specification demands homeservers to perform validation of the server-name and media-id     components of MXC URIs with the intent to prevent path traversal. However, it is not mentioned that a     similar check must also be performed on the client to prevent client-side path traversal. matrix-js-sdk     fails to perform this validation. (CVE-2024-50336)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.5.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2024-69 advisory.

  - The Matrix specification demands homeservers to perform validation of the server-name and media-id     components of MXC URIs with the intent to prevent path traversal. However, it is not mentioned that a     similar check must also be performed on the client to prevent client-side path traversal. matrix-js-sdk     fails to perform this validation. (CVE-2024-50336)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 574f7bc9-a141-11ef-84e9-901b0e9408dc advisory.

    matrix-js-sdk upstream reports:
    matrix-js-sdk before 34.11.0 is vulnerable to client-side               path traversal via crafted MXC URIs. A malicious room member               can trigger clients based on the matrix-js-sdk to issue               arbitrary authenticated GET requests to the client's               homeserver.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213070	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : MozillaThunderbird (SUSE-SU-2024:4326-1)	Nessus	SuSE Local Security Checks	medium
213034	Fedora 40 : thunderbird (2024-9b2a9cdf0b)	Nessus	Fedora Local Security Checks	medium
212752	Fedora 41 : thunderbird (2024-b32b4e1b88)	Nessus	Fedora Local Security Checks	medium
212514	Slackware Linux 15.0 / current mozilla-thunderbird Vulnerability (SSA:2024-346-01)	Nessus	Slackware Local Security Checks	medium
212420	Mozilla Thunderbird < 128.5.2	Nessus	Windows	medium
212419	Mozilla Thunderbird < 128.5.2	Nessus	MacOS X Local Security Checks	medium
210918	FreeBSD : Matrix clients -- mxc uri validation in js sdk (574f7bc9-a141-11ef-84e9-901b0e9408dc)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2024-50336

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium