Lucene search
Veracode Vulnerability DatabaseVERACODE:29840HistoryMar 27, 2021 - 10:52 p.m.
HTML Injection
2021-03-2722:52:41
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
13
matrix-synapse
html injection
notification emails
user's browser
software vulnerability
EPSS
0.001
Percentile
44.0%
matrix-synapse is vulnerable to HTML injection. Lack of output sanitization of the notification emails that are sent for notifications for missed messages or for an expiring account allows an attacker to inject and execute arbitrary HTML code in a user’s browser.
References
github.com/advisories/GHSA-c5f8-35qr-q4fm
github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df
github.com/matrix-org/synapse/pull/9200
github.com/matrix-org/synapse/pull/9200
github.com/matrix-org/synapse/releases/tag/v1.27.0
github.com/matrix-org/synapse/security/advisories/GHSA-c5f8-35qr-q4fm
lists.fedoraproject.org/archives/list/[email protected]/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/
security-tracker.debian.org/tracker/CVE-2021-21333
Related
osv
osv
PYSEC-2021-134
2021-03-26 20:15:00
CVE-2021-21333
2021-03-26 20:15:11
HTML injection in email and account expiry notifications
2021-03-26 19:53:04
prion
prion
Design/Logic Flaw
2021-03-26 20:15:00
cvelist
cvelist
CVE-2021-21333 HTML injection in email and account expiry notifications
2021-03-26 20:00:19
github
github
HTML injection in email and account expiry notifications
2021-03-26 19:53:04
cve
cve
CVE-2021-21333
2021-03-26 20:15:11
debiancve
debiancve
CVE-2021-21333
2021-03-26 20:15:11
ubuntucve
ubuntucve
CVE-2021-21333
2021-03-26 00:00:00
nvd
nvd
CVE-2021-21333
2021-03-26 20:15:11
openvas
openvas
Fedora: Security Advisory for matrix-synapse (FEDORA-2021-a627cfd31e)
2021-08-02 00:00:00
fedora
fedora
[SECURITY] Fedora 34 Update: matrix-synapse-1.38.1-1.fc34
2021-08-02 01:05:20