CVE-2023-32682 — Improper Authentication in Synapse

CWE-287 — Improper Authentication6 documents5 sources
Severity
5.4MEDIUMNVD
EPSS
1.0%
top 23.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Matrix-org SynapseMatrix Synapse
Timeline
PublishedJun 6

Description

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the `jwt_config.enabled` configuration setting. 2. The local password database is enabled via the `password_config.enabled` and `password_config.localdb_enabled` configuration settings *and* a user's password …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶NVDmatrix/synapse< 1.85.0
▶CVEListV5matrix-org/synapse< 1.85.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Synapse has improper checks for deactivated users during login↗2023-06-06
▶
OSV
CVE-2023-32682: Synapse is a Matrix protocol homeserver written in Python with the Twisted framework↗2023-06-06
▶
CVEList
Improper checks for deactivated users during login in synapse↗2023-06-06
▶
GHSA
Synapse has improper checks for deactivated users during login↗2023-06-06
▶

📋Vendor Advisories

1
Debian
CVE-2023-32682: matrix-synapse - Synapse is a Matrix protocol homeserver written in Python with the Twisted frame...↗2023
▶
CVE-2023-32682 — Improper Authentication in Synapse | cvebase