Veracode Vulnerability DatabaseVERACODE:31889Privilege Escalation
3.1 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:S/C:P/I:N/A:N
matrix-synapse is vulnerable to privilege escalation. Any unauthorized user who knows Room ID of a private room can disclose a private room’s name, avatar, topic, and number of members through Group/Community features.
References
github.com/matrix-org/synapse/commit/cb35df940a
github.com/matrix-org/synapse/pull/10723
github.com/matrix-org/synapse/releases/tag/v1.41.1
github.com/matrix-org/synapse/security/advisories/GHSA-jj53-8fmw-f2w2
lists.fedoraproject.org/archives/list/[email protected]/message/2VHDEPCZ22GJFMZCWA2XZAGPOEV72POF/
lists.fedoraproject.org/archives/list/[email protected]/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN/
Related
3.1 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:S/C:P/I:N/A:N