CVE-2021-21333

Katalog CVE

CVSS 6.1 · Medium EPSS 1,4%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada matrix synapse, fedoraproject fedora. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.

Rincian

Terbit di NVD

26 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 70,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df patch · advisory pihak ketiga
• https://github.com/matrix-org/synapse/pull/9200 patch · advisory pihak ketiga
• https://github.com/matrix-org/synapse/security/advisories/GHSA-c5f8-35qr-q4fm patch · advisory pihak ketiga
• https://github.com/matrix-org/synapse/releases/tag/v1.27.0 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM...