XSS in Matrix Synapse
CVE-2021-21333
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.014 (71.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 71st percentile — 71.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000
Affected products
- Matrix Synapse
- Matrix-Org Synapse — versions < 1.27.0
- Fedoraproject Fedora — versions 34
Weakness classification (CWE)
References
- github.com/matrix-org/synapse/releases/tag/v1.27.0 (Third Party Advisory)
- github.com/matrix-org/synapse/pull/9200 (Patch, Third Party Advisory)
- github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df (Patch, Third Party Advisory)
- github.com/matrix-org/synapse/security/advisories/GHSA-c5f8-35qr-q4fm (Patch, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
Frequently asked questions
- What is CVE-2021-21333?
- CVE-2021-21333 is a medium-severity vulnerability in Matrix Synapse, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 6.1/10. Published 2021-03-26.
- How severe is CVE-2021-21333?
- Medium severity. CVSS v3 base score is 6.1 out of 10.