GitHub Advisoryadvisory · PyPI

GHSA-ch5v-fhg8-7gv9 Matrix Synapse Authorization Error

HIGH Published 2022-05-13 Modified 2023-10-06 Official page ↗

Aliases: CVE-2018-12423
Ecosystem: PyPI
Packages: matrix-synapse
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Reviewed: 2023-07-22

Affected packages

• PyPI matrix-synapse: < 0.31.2 → fixed in 0.31.2

Description

In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no `m.room.power_levels` event in force.

Related

Alias · CVE (1)

CVE-2018-12423 In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force. vulnerability

References