CVE-2023-41335Low· 3.7▾ Sunlitmatrix-synapse vulnerable to temporary storage of plaintext passwords during password changes
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration.
These temporarily stored passwords are automatically erased after a 48-hour window.
https://github.com/matrix-org/synapse/pull/16272
This bug was due to a regression in https://github.com/matrix-org/synapse/pull/13188.
matrix-synapse >= 1.66.0, < 1.93.0Upgrade to a patched release:
matrix-synapse 1.93.0Connected by shared product, vendor, weakness, or advisory.
CVE-2023-42453Low· 3.1matrix-synapse vulnerable to improper validation of receipts allows forged read receipts
CVE-2023-45129Medium· 4.9matrix-synapse vulnerable to denial of service due to malicious server ACL events
CVE-2023-43796Medium· 5.3Synapse vulnerable to leak of remote user device information
CVE-2021-21274Medium· 4.3Denial of service attack via .well-known lookups
CVE-2023-32682Medium· 5.4Synapse has improper checks for deactivated users during login
CVE-2021-29471Low· 3.7Denial of service attack via push rule patterns in matrix-synapse