« Volver al listado

CVE-2024-53867

Estado: AplazadaMedia (4.3)—

Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Synapse — SynapseAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-53867",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-53867",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-03T19:07:06.315341Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "element-hq",
          "product": "synapse",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.113.0rc1, < 1.120.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-12-03T17:15:12.787",
  "references": [
    {
      "url": "https://github.com/element-hq/synapse/security/advisories/GHSA-56w4-5538-8v8h",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/matrix-org/matrix-spec-proposals/pull/4186",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-497"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1."
    },
    {
      "lang": "es",
      "value": " Synapse es un servidor doméstico Matrix de código abierto. La función Sliding Sync de las versiones de Synapse entre 1.113.0rc1 y 1.120.0 puede filtrar cambios parciales del estado de la sala a usuarios que ya no están en la sala. Los eventos que no son de estado, como los mensajes, no se ven afectados. Esta vulnerabilidad se solucionó en 1.120.1."
    }
  ],
  "lastModified": "2026-06-17T08:09:26.593",
  "sourceIdentifier": "security-advisories@github.com"
}