CVE-2021-21332: fedoraproject fedora Cross-site Scripting
Vulnerability summary
CVE-2021-21332 is a high (CVSS 8.2) Cross-site Scripting vulnerability in fedoraproject fedora. EPSS estimates a 1.22% chance of exploitation in the next 30 days, higher than 68.2% of scored vulnerabilities.
Timeline
- 26-03-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.
CVSS metrics
7 scores · 5 sources · 3 versions- CVE.orgCNA6.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:NDiffers
- OSV · PypiEcosystem advisory · calculated6.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
- OSV · DebianEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
EPSS trend
Probability
1.22%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
0.00 pp
From 1.22% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- matrix-synapse< 1.27.0-1
Fedoraproject1 product
- fedoraEOL34
Matrix1 product
- synapse< 1.27.0
Matrix-org1 product
- synapse< 1.27.0
PyPI1 product
- matrix-synapse< e54746bdf7d5c831eabe4dcea76a7626f1de73df | < 1.27.0
Ubuntu1 product
- matrix-synapseAll versions (No fix recorded)
6 vendors · 6 products
References
12 links- github.com/matrix-org/synapse/security/advisories/GHSA-246w-56m2-5899X Refsource CONFIRMWEBAdvisoryREPORTThird Party Advisory
- github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73dfX Refsource MISCWEBFIXPatchThird Party Advisory
