Detections
Analytics
SCA: security update for matrix-synapse (GHSA-4f74-84v3-j9q5)
low Tenable Self-Hosted Container Security Plugin ID 410126
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When
users update their passwords, the new credentials may be briefly held in the server database. While this
doesn't grant the server any added capabilities—it already learns the users' passwords as part of the
authentication process—it does disrupt the expectation that passwords won't be stored in the database. As
a result, these passwords could inadvertently be captured in database backups for a longer duration. These
temporarily stored passwords are automatically erased after a 48-hour window. This issue has been
addressed in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.
(CVE-2023-41335)
See Also
Plugin Details
Severity: Low
ID: 410126
Version: Revision 1.20
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.1
Percentile: 7.51
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 3.6
Temporal Score: 2.7
Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:P/A:N
CVSS Score Source: CVE-2023-41335
CVSS v3
Risk Factor: Low
Base Score: 3.7
Temporal Score: 3.2
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Low
Base Score: 2
Threat Score: 0.4
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 9/26/2023
Vulnerability Publication Date: 9/26/2023
Reference Information
CVE: CVE-2023-41335
cwe: CWE-312