CVE-2023-42453

MEDIUM EPSS 46.5%
Published Sep 27, 20232y ago · Modified Jun 17, 20261w ago
4.3 CVSS 3.1
Medium
Find Similar
Published Sep 27, 2023 2y ago
Last Modified Jun 17, 2026 1w ago

Description

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mark it as read. This could be confusing as clients will show the event as read by the user, even if they are not in the room. This issue has been patched in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS Details

Base Score
4.3
Exploitability
2.8
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
46.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-285

Affected Products 3

VendorProductVersionRange
matrixsynapse*≥1.34.0  –  <1.93.0
fedoraprojectfedora37any
fedoraprojectfedora38any

References 6

  • github.com https://github.com/matrix-org/synapse/pull/16327
    Issue TrackingPatch
  • github.com https://github.com/matrix-org/synapse/security/advisories/GHSA-7565-cq32-vx2x
    Vendor Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AFB2Y3S2VCPCN5P2XCZTG24MBMZ7DM4/
    Mailing ListRelease Notes
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65QPC55I4D27HIZP7H2NQ34EOXHPP4AO/
    Mailing ListRelease Notes
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6P4QULVUE254WI7XF2LWWOGHCYVFXFY/
  • security.gentoo.org https://security.gentoo.org/glsa/202401-12

Remediation

  • github.com https://github.com/matrix-org/synapse/pull/16327
    Issue TrackingPatch