CVE-2021-21332

Katalog CVE

CVSS 8.2 · High EPSS 1,2%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada matrix synapse, fedoraproject fedora. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.

Rincian

Terbit di NVD

26 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df patch · advisory pihak ketiga
• https://github.com/matrix-org/synapse/pull/9200 patch · advisory pihak ketiga
• https://github.com/matrix-org/synapse/releases/tag/v1.27.0 advisory pihak ketiga
• https://github.com/matrix-org/synapse/security/advisories/GHSA-246w-56m2-5899 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM...