CVE-2022-41904

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly (with warning shields). Therefore a malicious homeserver could inject messages into the room without the user being alerted that the messages were not sent by a verified group member, even if the user has previously verified all group members. This issue has been patched in Element iOS 1.9.7. There are currently no known workarounds.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-357

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-419056.1WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be sCVE-2022-419068.7OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon CVE-2022-419077.5TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ResizeNearestNeighborGrad` is given a large `size` input, it ovCVE-2022-419087.5TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in `CVE-2022-419097.5TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigCVE-2022-41918.8Use after free in Sign-In in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI inCVE-2022-419109.1TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes oCVE-2022-419117.5TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a `const char*` array (since that's CVE-2022-419129.8The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiCVE-2022-419135.4Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post ofCVE-2022-419143.7Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management(SCIM) account managementCVE-2022-419156.5Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, whe