CVE-2020-26257 — Cross-site Scripting in Synapse

CWE-79 — Cross-site ScriptingCWE-400 — Uncontrolled Resource ConsumptionCWE-74 — Injection6 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.5%
top 36.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Matrix-org SynapseMatrix SynapseFedoraproject Fedora
Timeline
PublishedDec 9

Description

Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDmatrix/synapse< 1.23.1
▶CVEListV5matrix-org/synapse< 1.23.1

Also affects: Fedora 32, 33

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
Denial of service attack via incorrect parameters in Matrix Synapse↗2020-12-09
▶
CVEList
Denial of service attack via incorrect parameters to federation APIs↗2020-12-09
▶
OSV
CVE-2020-26257: Matrix is an ecosystem for open federated Instant Messaging and VoIP↗2020-12-09
▶
OSV
Denial of service attack via incorrect parameters in Matrix Synapse↗2020-12-09
▶

📋Vendor Advisories

1
Debian
CVE-2020-26257: matrix-synapse - Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is...↗2020
▶
CVE-2020-26257 — Cross-site Scripting in Synapse | cvebase