PT-2023-28352 · Synapse+3 · Synapse+3

Lowerikjohnston · Published 2023-09-26 · Updated 2025-04-22 · CVE-2023-42453

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.93.0

Description The issue allows users to forge read receipts for any event if they know the room ID and event ID. Although users cannot view the events, they can mark them as read, potentially causing confusion as clients will display the event as read by the user, even if they are not in the room.

Recommendations For versions prior to 1.93.0, upgrade to version 1.93.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the read receipt functionality until a patch is applied. Note that there are no known workarounds for this issue, and upgrading to the patched version is the recommended course of action.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

ALT-PU-2024-3315

CVE-2023-42453

GHSA-7565-CQ32-VX2X

OPENSUSE-SU-2024:13270-1

PYSEC-2023-180

USN-7444-1

Affected Products

Alt Linux

Linuxmint

Synapse

Ubuntu

References · 35

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42453.json · Exploit
• https://github.com/matrix-org/synapse/security/advisories/GHSA-7565-cq32-vx2x · Vendor Advisory
• https://github.com/matrix-org/synapse/pull/16327 · Patch
• https://osv.dev/vulnerability/GHSA-7565-cq32-vx2x · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-42453 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7444-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-42453 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7444-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-42453 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53863 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42453 · Security Note
• https://ubuntu.com/security/CVE-2023-32683 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-42453 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-39335 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41335 · Vendor Advisory