CVE-2024-52815

Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's /sync functionality. Synapse 1.120.1 rejects such invalid invites received over federation and restores the ability to sync for affected users.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub_MCNA
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 27%
VendorProductVersion
matrixsynapse
𝑥
< 1.120.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
matrix-synapse
sid
1.136.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
matrix-synapse
oracular
ignored
noble
deferred
jammy
deferred
focal
deferred
bionic
deferred
Common Weakness Enumeration
References
https://github.com/element-hq/synapse/security/advisories/GHSA-f3r3-h2mq-hx2h