CVE-2024-26131
Published: 29 February 2024
Summary
CVE-2024-26131 is a high-severity Improper Restriction of Communication Channel to Intended Endpoints (CWE-923) vulnerability in Element Element. Its CVSS base score is 8.4 (High).
Operationally, ranked at the 13.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-23422
Vulnerability details
Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious application to start any internal activity by passing some extra parameters. Possible impact includes making Element Android display…
more
an arbitrary web page, executing arbitrary JavaScript; bypassing PIN code protection; and account takeover by spawning a login screen to send credentials to an arbitrary home server. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mandates restriction of the channel for authentication to only the intended trusted endpoints, blocking unauthorized communication paths.
Authorizing wireless access restricts the wireless communication channel to only intended endpoints.
Approving specific exchanges and documenting interface characteristics restricts communication channels to only intended endpoints and systems.
Enforces verification of the source of a communication channel by requiring identification and authentication of services first.
Limits physical connectivity to transmission channels, supporting restriction of communication paths to only intended endpoints.
Requiring providers to meet communication-channel restrictions and monitoring adherence reduces improper restriction of channels to intended endpoints.
Explicit control of VoIP traffic forces organizations to restrict communication channels to only intended endpoints and protocols.
Provides the means to verify the source of name-resolution responses instead of relying on unauthenticated channels.