PT-2023-27911 · Synapse+3 · Synapse+3

Published 2023-09-26 · Updated 2025-04-22 · CVE-2023-41335

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.93.0

Description The issue concerns the temporary storage of user passwords in the server database when users update their credentials. Although this does not grant the server any additional capabilities, it disrupts the expectation that passwords will not be stored in the database. As a result, these passwords could be inadvertently captured in database backups for a longer duration. The temporarily stored passwords are automatically erased after a 48-hour window.

Recommendations For versions prior to 1.93.0, upgrade to version 1.93.0 to address the issue. There are no known workarounds for this issue.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

ALT-PU-2024-3315

CVE-2023-41335

GHSA-4F74-84V3-J9Q5

OPENSUSE-SU-2024:13270-1

PYSEC-2023-185

USN-7444-1

Affected Products

Alt Linux

Linuxmint

Synapse

Ubuntu

References · 36

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41335.json · Exploit
• https://github.com/matrix-org/synapse/security/advisories/GHSA-4f74-84v3-j9q5 · Vendor Advisory
• https://github.com/matrix-org/synapse/pull/16272 · Patch
• https://osv.dev/vulnerability/USN-7444-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-42453 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7444-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53863 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-32683 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-41335 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41335 · Security Note
• https://ubuntu.com/security/CVE-2022-39335 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-185 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41335 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4f74-84v3-j9q5 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13270-1 · Vendor Advisory