Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an     ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password     reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends     on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other     browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent     domains. This is fixed in version 1.27.0. (CVE-2021-21332)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an
    ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password
    reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends
    on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other
    browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent
    domains. This is fixed in version 1.27.0. (CVE-2021-21332)

ID	Name	Product	Family	Severity
257119	Linux Distros Unpatched Vulnerability : CVE-2021-21332	Nessus	Misc.	high
408663	SCA: security update for matrix-synapse (GHSA-246w-56m2-5899)	Tenable Cloud Security	SCA Checks	medium
408663	SCA: security update for matrix-synapse (GHSA-246w-56m2-5899)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2021-21332

medium

Tenable Plugins

high

medium

medium