FreeBSD5F39D80F-107C-11EB-8B47-641C67A117D8py-matrix-synapse -- XSS vulnerability
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
53.0%
Matrix developers reports:
The fallback authentication endpoint served via Synapse were vulnerable
to cross-site scripting (XSS) attacks. The impact depends on the
configuration of the domain that Synapse is deployed on, but may allow
access to cookies and other browser data, CSRF vulnerabilities, and
access to other resources served on the same domain or parent domains.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| FreeBSD | any | noarch | py36-matrix-synapse | < 1.21.0 | UNKNOWN |
| FreeBSD | any | noarch | py37-matrix-synapse | < 1.21.0 | UNKNOWN |
| FreeBSD | any | noarch | py38-matrix-synapse | < 1.21.0 | UNKNOWN |
| FreeBSD | any | noarch | py39-matrix-synapse | < 1.21.0 | UNKNOWN |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
53.0%