PT-2023-27911 · Synapse+3 · Synapse+3

CVE-2023-41335 · Publicado 2023-09-26 · Atualizado 2025-04-22

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.93.0

Description The issue concerns the temporary storage of user passwords in the server database when users update their credentials. Although this does not grant the server any additional capabilities, it disrupts the expectation that passwords will not be stored in the database. As a result, these passwords could be inadvertently captured in database backups for a longer duration. The temporarily stored passwords are automatically erased after a 48-hour window.

Recommendations For versions prior to 1.93.0, upgrade to version 1.93.0 to address the issue. There are no known workarounds for this issue.

Exploit

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

ALT-PU-2024-3315

CVE-2023-41335

GHSA-4F74-84V3-J9Q5

OPENSUSE-SU-2024:13270-1

PYSEC-2023-185

USN-7444-1

Produtos afetados

Alt Linux

Linuxmint

Synapse

Ubuntu

Referências · 36

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41335.json · Exploit
• https://github.com/matrix-org/synapse · Nota
• https://github.com/matrix-org/synapse/pull/16272 · Correção
• https://github.com/matrix-org/synapse/security/advisories/GHSA-4f74-84v3-j9q5 · Aviso do Fabricante
• https://github.com/matrix-org/synapse/pull/13188 · Nota
• https://github.com/matrix-org/synapse/commit/69b74d9330e42fc91a9c7423d00a06cd6d3732bf · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2023-185.yaml · Nota
• https://cve.org/CVERecord?id=CVE-2023-41335 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-41335 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-32683 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2AFB2Y3S2VCPCN5P2XCZTG24MBMZ7DM4 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/65QPC55I4D27HIZP7H2NQ34EOXHPP4AO · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-4863 · Nota
• https://ubuntu.com/security/CVE-2023-42453 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-42453 · Nota