7 matches found
PYSEC-2020-238
AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the...
Design/Logic Flaw
AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the...
UBUNTU-CVE-2020-26891
AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the...
CVE-2020-26891
CVE-2020-26891 affects Matrix Synapse prior to version 1.21.0. The vulnerability is an XSS flaw in AuthRestServlet caused by unsafe interpolation of the session GET parameter, which could allow an attacker to craft a malicious URL that triggers script execution on the Synapse-hosted domain via en...
CVE-2020-26891
AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the...
CVE-2020-26891: Improper Neutralization of Input During Web Page Generation
AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the...
PT-2020-16533
Name of the Vulnerable Software and Affected Versions Matrix Synapse versions prior to 1.21.0 Description The issue is due to unsafe interpolation of the session GET parameter in the AuthRestServlet, allowing a remote attacker to execute a cross-site scripting XSS attack. This can be done by...