CVE-2021-21333
published 2021-03-26CVE-2021-21333: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP…
PriorityP429medium6.1CVSS 3.1
AVNACHPRNUIRSCCNIHAN
EPSS
1.39%
69.4th percentile
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | matrix-synapse | < matrix-synapse 1.27.0-1 (forky) | matrix-synapse 1.27.0-1 (forky) |
| fedoraproject | fedora | — | — |
| matrix-org | synapse | < 1.27.0 | 1.27.0 |
| matrix | synapse | < 1.27.0 | 1.27.0 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2021-21333: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse)
osv·2021-03-26·CVSS 6.1
CVE-2021-21333 [MEDIUM] CVE-2021-21333: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse)
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.
OSV
HTML injection in email and account expiry notifications
osv·2021-03-26
CVE-2021-21333 [MEDIUM] HTML injection in email and account expiry notifications
HTML injection in email and account expiry notifications
### Impact
The notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email.
The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker.
### Patches
This issue is fixed in #9200.
### Workarounds
For the missed messages notifications:
The `notif.html`, `notif_mail.html`, and `room.html` templates can be overridden with custom templates that manually escapes the variables using [JInja2's `escape` filter](https://jinja.palletsprojects.com/en/2.11.x/templates/#escape). See the `email.template_dir` setti
GHSA
HTML injection in email and account expiry notifications
ghsa·2021-03-26
CVE-2021-21333 [MEDIUM] CWE-74 HTML injection in email and account expiry notifications
HTML injection in email and account expiry notifications
### Impact
The notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email.
The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker.
### Patches
This issue is fixed in #9200.
### Workarounds
For the missed messages notifications:
The `notif.html`, `notif_mail.html`, and `room.html` templates can be overridden with custom templates that manually escapes the variables using [JInja2's `escape` filter](https://jinja.palletsprojects.com/en/2.11.x/templates/#escape). See the `email.template_dir` setti
Debian
CVE-2021-21333: matrix-synapse - Synapse is a Matrix reference homeserver written in python (pypi package matrix-...
vendor_debian·2021·CVSS 6.1
CVE-2021-21333 [MEDIUM] CVE-2021-21333: matrix-synapse - Synapse is a Matrix reference homeserver written in python (pypi package matrix-...
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.
Scope: local
forky: resolved (fixed in 1.27.0-1)
sid: resolved (fixed in 1.27.0-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73dfhttps://github.com/matrix-org/synapse/pull/9200https://github.com/matrix-org/synapse/releases/tag/v1.27.0https://github.com/matrix-org/synapse/security/advisories/GHSA-c5f8-35qr-q4fmhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73dfhttps://github.com/matrix-org/synapse/pull/9200https://github.com/matrix-org/synapse/releases/tag/v1.27.0https://github.com/matrix-org/synapse/security/advisories/GHSA-c5f8-35qr-q4fmhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/
2021-03-26
Published