PT-2018-11162 · Matrix.Org+2 · Synapse+2

Matthew Hodgson · Published 2018-06-14 · Updated 2023-05-16 · CVE-2018-12423

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 0.31.2

Description The issue allows unauthorized users to hijack rooms when there is no m.room.power levels event in force. This can lead to unauthorized access and control over rooms.

Recommendations For versions prior to 0.31.2, update to version 0.31.2 or later to resolve the issue. As a temporary workaround, consider implementing strict access controls to rooms and ensuring that m.room.power levels events are properly configured to minimize the risk of exploitation.

Fix

Related Identifiers

ALT-PU-2018-1973

CVE-2018-12423

GHSA-CH5V-FHG8-7GV9

USN-6076-1

Affected Products

Alt Linux

Synapse

Ubuntu

References · 21

• https://ubuntu.com/security/notices/USN-6076-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12291 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12423 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-12423 · Security Note
• https://osv.dev/vulnerability/GHSA-ch5v-fhg8-7gv9 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-12423 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6076-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12423 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-5885 · Vendor Advisory
• https://matrix.org/blog/2018/06/14/security-update-synapse-0-31-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10657 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12423 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12423 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16515 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11842 · Vendor Advisory