VDB
CVE-2023-32682
CVE-2023-32682
PUBLISHED
CVSS 5.400000095367432 MEDIUM
Synapse has improper checks for deactivated users during login
EPSS 0.75% · 53.5th percentile
Risk Scores
CVSS 3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score
0.75%
53.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| matrix-org | synapse | *, < 1.85.0 |
| PyPI | matrix-synapse | 0, 0 |
| matrix | synapse | 0, 0 |
Timeline
- May 19, 2023 Fix PR Merged
- Jun 6, 2023 CVE Published
- Jun 7, 2023 EPSS Score
- Jul 13, 2023 EPSS Score
- Aug 19, 2023 EPSS Score
- Sep 24, 2023 EPSS Score
- Oct 31, 2023 EPSS Score
- Dec 6, 2023 EPSS Score
- Jan 12, 2024 EPSS Score
- Feb 17, 2024 EPSS Score
- Apr 30, 2024 EPSS Score
- Jun 5, 2024 EPSS Score
References
- https://matrix-org.github.io/synapse/latest/admin_api/user_admin_api.html#create-or-modify-account url
- https://github.com/matrix-org/synapse/security/advisories/GHSA-26c5-ppr8-f33p url
- https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#password_config url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6DH5A5YEB5LRIPP32OUW25FCGZFCZU2/ url
- https://github.com/matrix-org/synapse/pull/15634 patch
- https://nvd.nist.gov/vuln/detail/CVE-2023-32682 advisory
- https://github.com/matrix-org/synapse/releases/tag/v1.85.0 url
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2023-84.yaml url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6DH5A5YEB5LRIPP32OUW25FCGZFCZU2 url
- https://matrix-org.github.io/synapse/latest/jwt.html url
- https://github.com/matrix-org/synapse/pull/15624 url
- https://github.com/matrix-org/synapse/issues/12274 url
- https://github.com/matrix-org/synapse package