Detections
Analytics

SCA: security update for matrix-synapse (GHSA-3hfw-x7gx-437c)

high Tenable Cloud Security Plugin ID 409545

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse
 instances with the media repository enabled can be tricked into downloading a file from a remote server
 into an arbitrary directory. No authentication is required for the affected endpoint. The last 2
 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an
 attacker, which limits the impact. Homeservers with the media repository disabled are unaffected.
 Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname,
 including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or
 later. Server administrators using a reverse proxy could, at the expense of losing media functionality,
 may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be
 adapted to use the hardened systemd config. (CVE-2021-41281)

See Also

https://github.com/advisories/GHSA-3hfw-x7gx-437c

Plugin Details

Severity: High

ID: 409545

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2021-41281

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/23/2021

Vulnerability Publication Date: 11/23/2021

Reference Information

CVE: CVE-2021-41281

cwe: CWE-22