Veracode Vulnerability DatabaseVERACODE:40766Access Restriction Bypass
5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
4.6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:H/Au:S/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
41.7%
matrix-synapse is vulnerable to Access Restriction Bypass. The vulnerability exists because it does not properly check authorization events, which allows a remote attacker to bypass access restrictions and gain access to a server room.
References
github.com/matrix-org/synapse/commit/c06b2b714262825e1d2510b62c38fdeda339f6dc
github.com/matrix-org/synapse/issues/13288
github.com/matrix-org/synapse/pull/13823
github.com/matrix-org/synapse/security/advisories/GHSA-45cj-f97f-ggwv
lists.fedoraproject.org/archives/list/[email protected]/message/T2MBNMZAFY4RCZL2VGBGAPKGB4JUPZVS/
Related
5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
4.6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:H/Au:S/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
41.7%