NVD Vulnerability Detail

CVE-2021-21332

Summary	Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.
Publication Date	March 27, 2021, 5:15 a.m.
Registration Date	March 27, 2021, 12:02 p.m.
Last Update	Nov. 21, 2024, 2:48 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:matrix:synapse::::::::					1.27.0

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:fedoraproject:fedora:34:::::::*

Related information, measures and tools

No	URL	タグ
1	https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df	Patch Third Party Advisory
2	https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df	Patch Third Party Advisory
3	https://github.com/matrix-org/synapse/pull/9200	Patch Third Party Advisory
4	https://github.com/matrix-org/synapse/pull/9200	Patch Third Party Advisory
5	https://github.com/matrix-org/synapse/releases/tag/v1.27.0	Third Party Advisory
6	https://github.com/matrix-org/synapse/releases/tag/v1.27.0	Third Party Advisory
7	https://github.com/matrix-org/synapse/security/advisories/GHSA-246w-56m2-5899	Third Party Advisory
8	https://github.com/matrix-org/synapse/security/advisories/GHSA-246w-56m2-5899	Third Party Advisory
9	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

Synapse におけるクロスサイトスクリプティングの脆弱性

Title	Synapse におけるクロスサイトスクリプティングの脆弱性
Summary	Synapse には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 16, 2021, midnight
Registration Date	April 6, 2021, 2:33 p.m.
Last Update	April 6, 2021, 2:33 p.m.

Affected System

Matrix

Synapse 1.27.0 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-21332	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21332
National Vulnerability Database (NVD)
2	CVE-2021-21332	https://nvd.nist.gov/vuln/detail/CVE-2021-21332

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
GitHub
1	Clean-up the template loading code #9200	https://github.com/matrix-org/synapse/pull/9200#issue-559503685
2	Clean-up the template loading code. (#9200)	https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df
3	Cross-site scripting (XSS) vulnerability in the password reset endpoint	https://github.com/matrix-org/synapse/security/advisories/GHSA-246w-56m2-5899
4	Synapse 1.27.0 (2021-02-16)	https://github.com/matrix-org/synapse/releases/tag/v1.27.0

Change Log

No	Changed Details	Date of change
1	[2021年04月06日] 掲載	April 6, 2021, 2:33 p.m.