CVE-2021-39164
published 2021-08-31CVE-2021-39164: Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list…
PriorityP414low3.1CVSS 3.1
AVNACHPRLUINSUCLINAN
EPSS
1.46%
70.6th percentile
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | matrix-synapse | < matrix-synapse 1.41.1-1 (forky) | matrix-synapse 1.41.1-1 (forky) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| matrix-org | synapse | < 1.41.1 | 1.41.1 |
| matrix | synapse | < 1.41.1 | 1.41.1 |
CVSS provenance
nvdv3.13.1LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:P/I:N/A:N
osv3.1LOW
vendor_debian3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper authorisation of members discloses room membership to non-members
ghsa·2021-09-01
CVE-2021-39164 [LOW] CWE-200 Improper authorisation of members discloses room membership to non-members
Improper authorisation of members discloses room membership to non-members
### Impact
Unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room.
### Patches
Server administrators should upgrade to 1.41.1 or later.
### Workarounds
Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the following endpoints:
* `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter
* `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter
### References
n/a
OSV
Improper authorisation of members discloses room membership to non-members
osv·2021-09-01
CVE-2021-39164 [LOW] Improper authorisation of members discloses room membership to non-members
Improper authorisation of members discloses room membership to non-members
### Impact
Unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room.
### Patches
Server administrators should upgrade to 1.41.1 or later.
### Workarounds
Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the following endpoints:
* `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter
* `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter
### References
n/a
OSV
CVE-2021-39164: Matrix is an ecosystem for open federated Instant Messaging and Voice over IP
osv·2021-08-31·CVSS 3.1
CVE-2021-39164 [LOW] CVE-2021-39164: Matrix is an ecosystem for open federated Instant Messaging and Voice over IP
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with
Debian
CVE-2021-39164: matrix-synapse - Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. I...
vendor_debian·2021·CVSS 3.1
CVE-2021-39164 [LOW] CVE-2021-39164: matrix-synapse - Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. I...
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/matrix-org/synapse/commit/cb35df940ahttps://github.com/matrix-org/synapse/releases/tag/v1.41.1https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w3qhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VHDEPCZ22GJFMZCWA2XZAGPOEV72POF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN/https://github.com/matrix-org/synapse/commit/cb35df940ahttps://github.com/matrix-org/synapse/releases/tag/v1.41.1https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w3qhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VHDEPCZ22GJFMZCWA2XZAGPOEV72POF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN/
2021-08-31
Published