Information Exposure Affecting matrix-synapse package, versions [,1.41.1)
Threat Intelligence
EPSS
0.08% (37th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-MATRIXSYNAPSE-1579722
- published 2 Sep 2021
- disclosed 1 Sep 2021
- credit Unknown
Introduced: 1 Sep 2021
CVE-2021-39164 Open this link in a new tabHow to fix?
Upgrade matrix-synapse to version 1.41.1 or higher.
Overview
matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.
Affected versions of this package are vulnerable to Information Exposure. Unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room.
References
CVSS Scores
version 3.1