CVE-2024-37303

Katalog CVE

CVSS 5.3 · Medium EPSS 0,43%

Kerentanan Missing Authentication for Critical Function pada matrix synapse. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. Synapse 1.106 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector.

Rincian

Terbit di NVD

3 Desember 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/element-hq/synapse/security/advisories/GHSA-gjgr-7834-rhxr advisory vendor
• https://github.com/matrix-org/matrix-spec-proposals/pull/3916 issue tracking · patch