Detections
Analytics

SCA: security update for matrix-synapse (GHSA-3x4c-pq33-4w3q)

low Tenable Self-Hosted Container Security Plugin ID 409754

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and
 prior, unauthorised users can access the membership (list of members, with their display names) of a room
 if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility.
 Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the
 room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One
 workaround is available. Administrators of servers that use a reverse proxy could, with potentially
 unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with
 `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter.
 (CVE-2021-39164)

See Also

https://github.com/advisories/GHSA-3x4c-pq33-4w3q

Plugin Details

Severity: Low

ID: 409754

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 3.5

Temporal Score: 2.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2021-39164

CVSS v3

Risk Factor: Low

Base Score: 3.1

Temporal Score: 2.7

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/1/2021

Vulnerability Publication Date: 8/31/2021

Reference Information

CVE: CVE-2021-39164

cwe: CWE-200