CVE Vulnerability

CVE-2020-26891

AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the /_matrix/client/r0/auth/*/fallback/web or /_matrix/client/unstable/auth/*/fallback/web Synapse endpoints.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://matrix.org/blog/2020/10/15/synapse-1-21-2-released-and-security-advisory Release Notes Vendor Advisory
https://github.com/matrix-org/synapse/pull/8444 Issue Tracking Patch
https://github.com/matrix-org/synapse/releases/tag/v1.21.2 Release Notes Third Party Advisory
https://github.com/matrix-org/synapse/security/advisories/GHSA-3x8c-fmpc-5rmq Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*
Information

Published : 2020-10-19 05:15

Updated : 2020-10-26 09:30

NVD link : CVE-2020-26891

Mitre link : CVE-2020-26891

Products Affected
No products.
CWE
CWE-79