Detections
Analytics

SCA: security update for matrix-synapse (GHSA-jj53-8fmw-f2w2)

low Tenable Cloud Security Plugin ID 416406

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and
 prior, unauthorised users can access the name, avatar, topic and number of members of a room if they know
 the ID of the room. This vulnerability is limited to homeservers where the vulnerable homeserver is in the
 room and untrusted users are permitted to create groups (communities). By default, only homeserver
 administrators can create groups. However, homeserver administrators can already access this information
 in the database or using the admin API. As a result, only homeservers where the configuration setting
 `enable_group_creation` has been set to `true` are impacted. Server administrators should upgrade to
 1.41.1 or higher to patch the vulnerability. There are two potential workarounds. Server administrators
 can set `enable_group_creation` to `false` in their homeserver configuration (this is the default value)
 to prevent creation of groups by non-administrators. Administrators that are using a reverse proxy could,
 with partial loss of group functionality, block the endpoints `/_matrix/client/r0/groups/{group_id}/rooms`
 and `/_matrix/client/unstable/groups/{group_id}/rooms`. (CVE-2021-39163)

See Also

https://github.com/advisories/GHSA-jj53-8fmw-f2w2

Plugin Details

Severity: Low

ID: 416406

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 3.5

Temporal Score: 2.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2021-39163

CVSS v3

Risk Factor: Low

Base Score: 3.1

Temporal Score: 2.7

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Low

Base Score: 2.3

Threat Score: 0.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/1/2021

Vulnerability Publication Date: 8/31/2021

Reference Information

CVE: CVE-2021-39163

cwe: CWE-200