PT-2023-28352 · Synapse+3 · Synapse+3

Lowerikjohnston · Publicado 2023-09-26 · Atualizado 2025-04-22 · CVE-2023-42453

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.93.0

Description The issue allows users to forge read receipts for any event if they know the room ID and event ID. Although users cannot view the events, they can mark them as read, potentially causing confusion as clients will display the event as read by the user, even if they are not in the room.

Recommendations For versions prior to 1.93.0, upgrade to version 1.93.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the read receipt functionality until a patch is applied. Note that there are no known workarounds for this issue, and upgrading to the patched version is the recommended course of action.

Exploit

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

ALT-PU-2024-3315

CVE-2023-42453

GHSA-7565-CQ32-VX2X

OPENSUSE-SU-2024:13270-1

PYSEC-2023-180

USN-7444-1

Produtos afetados

Alt Linux

Linuxmint

Synapse

Ubuntu

Referências · 35

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42453.json · Exploit
• https://github.com/matrix-org/synapse/security/advisories/GHSA-7565-cq32-vx2x · Aviso do Fabricante
• https://github.com/matrix-org/synapse/pull/16327 · Correção
• https://github.com/matrix-org/synapse/commit/63d28a88c1d18c64ea7e23b6dd7483e6d5dcf881 · Nota
• https://github.com/matrix-org/synapse · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2023-180.yaml · Nota
• https://security.gentoo.org/glsa/202401-12 · Nota
• https://osv.dev/vulnerability/GHSA-7565-cq32-vx2x · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-42453 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-7444-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-42453 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-7444-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-42453 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2024-53863 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-42453 · Nota de Segurança