Matrix Synapse Authorization Error · CVE-2018-12423 · GitHub Advisory Database · GitHub

Matrix Synapse Authorization Error

High severity GitHub Reviewed Published May 13, 2022 to the GitHub Advisory Database • Updated Oct 6, 2023

Package

matrix-synapse (pip)

Affected versions

< 0.31.2

Patched versions

0.31.2

Description

In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.

References

Published by the National Vulnerability Database

Jun 14, 2018

Published to the GitHub Advisory Database May 13, 2022

Reviewed Jul 22, 2023

Last updated Oct 6, 2023

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N