Vulnerability in Matrix Synapse
CVE-2023-41335
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any add…
EPSS: 0.004 (28.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Matrix Synapse
- Matrix-org Synapse — versions >= 1.66.0, < 1.93.0
- Fedoraproject Fedora — versions 37, 38
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Mailing List, Release Notes)
- security-advisories@github.com (Mailing List, Release Notes)
- security-advisories@github.com
- security-advisories@github.com
Frequently asked questions
- What is CVE-2023-41335?
- CVE-2023-41335 is a low-severity vulnerability in Matrix Synapse, classified under Cleartext Storage of Sensitive Information. CVSS score: 3.7/10. Published 2023-09-27.
- How severe is CVE-2023-41335?
- Low severity. CVSS v3 base score is 3.7 out of 10.